Listen to this Post
The CVE-2025-13261 vulnerability exists in the lsfusion platform versions up to 6.1. It is a path traversal flaw in the DownloadFileRequestHandler function within the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. The issue stems from inadequate sanitization of the ‘Version’ parameter during file download requests. Attackers can manipulate this argument by injecting directory traversal sequences, such as ‘../’, to access arbitrary files on the server filesystem. Remote exploitation is feasible, meaning attackers can launch attacks over the network without prior authentication. The publicly disclosed exploit demonstrates how crafted HTTP requests with malicious Version values can bypass directory restrictions. This vulnerability primarily compromises confidentiality by allowing unauthorized reading of sensitive files. The CVSS 4.0 score rates it as medium severity (5.5), reflecting the limited impact on integrity and availability. The function’s failure to validate user input enables the traversal, highlighting common web security pitfalls. Organizations using affected lsfusion deployments should assess exposure immediately.
Platform: lsfusion
Version: up to 6.1
Vulnerability: Path Traversal
Severity: Medium
Date: 2025-11-16
Prediction: Expected patch 2025-12
What Undercode Say:
Analytics:
curl “http://target/download?version=../../../etc/passwd”
java code snippet:
public void handleDownload(String version) {
File file = new File(basePath + version);
}
grep -r “DownloadFileRequestHandler” src/
How Exploit:
Remote attackers craft HTTP requests with traversal sequences in the Version parameter to read arbitrary files, such as configuration or system files.
Protection from this CVE:
Apply vendor patch, validate input, restrict file access permissions.
Impact:
Unauthorized file disclosure, potential information leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
