VULNERABILITY INTELLIGENCE
CVE-2025-32807
CVSS score5.3 MEDIUM
EPSS probability0.63%
CISA KEVNot currently listed
Published2025-04-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.
Weakness classification
- cve@mitre.org: CWE-24