p PatchFirst

CVE-2025-32807

CVE-2025-32807

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

CVSS 5.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • fusiondirectory

    Versions
    • ≥ 0, < 1.5: Affected (custom)

    Update to 1.5

  • fusiondirectory Debian:11

    Versions
    • 1.3-4
    • 1.3-4+deb11u1
    • 1.3-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fusiondirectory Ubuntu:16.04:LTS

    Versions
    • 1.0.8.8-3
    • 1.0.8.8-3ubuntu1
    • 1.0.8.8-3ubuntu2
    • 1.0.8.8-3ubuntu2.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fusiondirectory Ubuntu:18.04:LTS

    Versions
    • 1.0.19-1
    • 1.0.19-1ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fusiondirectory Ubuntu:20.04:LTS

    Versions
    • 1.2.3-5
    • 1.3-1
    • 1.3-1ubuntu1
    • 1.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fusiondirectory Ubuntu:22.04:LTS

    Versions
    • 1.3-4build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →