CVE-2025-1782
Critical
Description
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.
SeverityCritical
CVSS9.9
Exploit probability—
ProductAvantfax
PublishedApr 14, 2025
First seenApr 14, 2025
Weakness typeCWE-94Code injection
How to fix
Update
- avantfax avantfax3.4.1 or later
- ifax hylafax1.2.1, 1.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avantfax avantfax | v < 3.4.1 | 3.4.1 |
| ifax hylafax | v < 1.2.1, 1.3.0 ≤ v < 1.3.2 | 1.2.1, 1.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.