CVE-2025-32807

—

CVSS 3.1

5.3 medium

EPSS

<1%p47

Published

Apr 11, 2025 (Apr 11, 2025)

Modified

Jun 17, 2026

Description

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

Weakness: CWE-24
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.