{"id":"CVE-2025-13265","aliases":["GHSA-8wf8-frjg-xv74"],"url":"https://o3.security/vulnerability/CVE-2025-13265","summary":"lsfusion platform ZipUtils.java unpackFile path traversal","details":"A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.","published":"2025-11-17T05:32:05.557Z","modified":"2026-08-12T03:51:42.455208060Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"lsfusion.platform:server","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13265.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13265"},{"type":"ADVISORY","url":"https://vuldb.com/?id.332600"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.689427"},{"type":"REPORT","url":"https://github.com/lsfusion/platform/issues/1545"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.332600"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.455208060Z"}}