CVE-2025-32807: 
Linux Debian vulnerability analysis and mitigation

A path traversal vulnerability was discovered in FusionDirectory versions before 1.5, identified as CVE-2025-32807. The vulnerability allows remote attackers to read arbitrary files on the host system that end with specific file extensions (.png, .svg, or .xpm) through the icon parameter of a GET request to geticon.php (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is categorized as CWE-24 (Path Traversal: '../filedir'). The vulnerability exists in the icon parameter handling of geticon.php, where insufficient input validation allows for directory traversal attacks (NVD).

When exploited, this vulnerability allows attackers to read arbitrary files from the host system, provided they end with .png extension (and .svg or .xpm in some configurations). This poses a security risk as it could lead to unauthorized access to sensitive files matching these extensions (NVD).

The vulnerability has been fixed in FusionDirectory version 1.5. Users are advised to upgrade to this version or later to mitigate the security risk (GitLab Commit).