Threat Investigation
Request a demo

CVE-2025-32807

Medium

Description

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

SeverityMedium
CVSS5.3
Exploit probability51. percentile0.6%
ProductFusionDirectory
PublishedApr 11, 2025
First seenApr 11, 2025
Weakness typeCWE-24CWE-24

How to fix

Update
  • FusionDirectory FusionDirectory1.5 or later

Affected products

ProductAffected versionsFixed in
FusionDirectory FusionDirectoryv < 1.51.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.