CVE-2025-32807

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-24

Affected software

VendorProductVersions
FusionDirectoryFusionDirectory< 1.5

References

Timeline

Published
Apr 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-328087.7W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because CVE-2025-328095.4W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedbacCVE-2025-32815.3The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure DCVE-2025-328137.2An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.CVE-2025-328149.8An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.CVE-2025-328156.5An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.CVE-2025-328163.1CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.CVE-2025-328176.1A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorizCVE-2025-328187.5A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash tCVE-2025-328198.8A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete CVE-2025-32825.3The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure DCVE-2025-328208.8A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make an