CVE-2025-13262: lsFusion Platform has a Path Traversal vulnerability

November 17, 2025 (updated November 27, 2025)

A vulnerability was determined in lsfusion platform up to 6.1. Affected by this vulnerability is the function UploadFileRequestHandler of the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Executing manipulation of the argument sid can lead to path traversal. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

References

github.com/advisories/GHSA-gwwr-j923-vq7r
github.com/lsfusion/platform
github.com/lsfusion/platform/issues/1544
github.com/lsfusion/platform/issues/1544
nvd.nist.gov/vuln/detail/CVE-2025-13262
vuldb.com/?ctiid.332597
vuldb.com/?id.332597
vuldb.com/?submit.689414

Code Behaviors & Features

Detect and mitigate CVE-2025-13262 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →