CVE-2025-13265: 
Java vulnerability analysis and mitigation

CVE-2025-13265 is a path traversal (Zip Slip) vulnerability in the lsFusion platform affecting versions up to and including 6.1. The flaw resides in the unpackFile function within server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java, allowing attackers to write or overwrite files outside the intended extraction directory during ZIP decompression. It was publicly disclosed on November 17, 2025, with the underlying issue reported on November 5, 2025. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) with no privileges required per the network-based attack vector (Feedly, GitHub Issue).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The unpackFile method in ZipUtils.java, invoked by MakeUnzipFileAction and also triggered via EmailReceiver, does not validate or sanitize filenames or symbolic links within ZIP archives before extraction. An attacker can craft a ZIP file containing entries with path traversal sequences (e.g., ../../etc/cron.d/malicious) that, when extracted server-side, write files to arbitrary filesystem locations outside the intended directory. A proof-of-concept demonstrating the issue by passing a ZIP with traversal sequences to ZipUtils.unpackFile() directly has been published (GitHub Issue).

Successful exploitation allows an attacker to overwrite or delete arbitrary files on the server's filesystem with the permissions of the lsFusion server process. This can result in high integrity impact (e.g., overwriting configuration files, web shells, or application binaries) and high availability impact (e.g., deleting critical system or application files causing denial of service). Confidentiality impact is not directly indicated by the CVSS v3.1 scoring, though file overwrite primitives can be chained to achieve code execution or further lateral movement (Feedly, GitHub Issue).

A proof-of-concept exploit is publicly available on GitHub demonstrating the path traversal via a crafted ZIP file passed to ZipUtils.unpackFile(). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, reflecting low current exploitation probability. The CVSS v3.1 score indicates no authentication is required for exploitation, though the CVSS v4.0 scoring (5.3 Medium) reflects a low-privilege requirement in some contexts (Feedly, GitHub Issue).

1. Craft a malicious ZIP archive: Create a ZIP file containing one or more entries with path traversal sequences in their filenames (e.g., ../../etc/cron.d/backdoor or ../../var/www/html/shell.jsp).
2. Identify the target: Locate an internet-accessible lsFusion platform instance running version 6.1 or earlier.
3. Trigger ZIP extraction: Submit the malicious ZIP file to the server via a feature that invokes MakeUnzipFileAction (e.g., a file upload or email attachment processed by EmailReceiver).
4. Achieve arbitrary file write: The unpackFile method in ZipUtils.java extracts the archive without sanitizing entry paths, writing files to attacker-controlled locations on the server filesystem.
5. Escalate or persist: Overwrite a web-accessible file with a web shell, modify a cron job, or delete critical application files to achieve code execution or denial of service (GitHub Issue).

• File System: Unexpected files appearing outside the designated extraction/upload directory (e.g., new files in /etc/, /var/www/, or application root); modification timestamps on system or configuration files coinciding with ZIP upload events.
• Logs: Server-side logs showing ZIP extraction operations followed by file write errors or successes in unexpected directories; EmailReceiver processing logs referencing unusual attachment filenames containing ../ sequences.
• Network: Inbound requests uploading ZIP files to lsFusion endpoints, particularly from unexpected or external IP addresses; outbound connections from the server process following file extraction events (potential post-exploitation).
• Process: Unexpected processes spawned by the lsFusion Java process (e.g., shells or interpreters) if a web shell or script was successfully written (GitHub Issue).

Upgrade lsFusion platform to a version beyond 6.1 where the patch has been applied. As an interim measure, restrict network access to the lsFusion platform to authorized users and systems only, and disable or filter email attachment processing via EmailReceiver if not required. Monitor file system access for suspicious activity involving path traversal attempts and review access logs for unauthorized file operations on systems running vulnerable versions (GitHub Issue, Feedly).

The vulnerability was reported by researcher R1ckyZ via the lsFusion GitHub issue tracker on November 5, 2025, and received a CVE assignment shortly after. Red Hat tracked the CVE in their security advisory database. No significant broader media coverage or notable public researcher commentary beyond the original disclosure has been identified (GitHub Issue, Red Hat Advisory).