CVE-2025-32807

Description

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

Reserved 2025-04-10 | Published 2025-04-10 | Updated 2025-04-11 | Assigner mitre

Problem types

CWE-24 Path Traversal: '../filedir'

Product status

Default status
unaffected

Any version before 1.5
affected

References

gitlab.fusiondirectory.org/...bd/include/class_IconTheme.inc

gitlab.fusiondirectory.org/...7450d665a141c5e94db8a06d208556

gitlab.fusiondirectory.org/...22e15b9bd/Changelog.md?plain=1

cve.org (CVE-2025-32807)

nvd.nist.gov (CVE-2025-32807)

Download JSON