FusionDirectory up to 1.4 geticon.php icon path traversal

Summaryinfo

A vulnerability was found in FusionDirectory up to 1.4 and classified as problematic. The affected element is an unknown function of the file geticon.php. Executing a manipulation of the argument icon can lead to path traversal. This vulnerability is registered as CVE-2025-32807. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in FusionDirectory up to 1.4 and classified as problematic. This vulnerability affects an unknown code of the file geticon.php. The manipulation of the argument icon with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-24. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality. CVE summarizes:

A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.

The advisory is shared for download at gitlab.fusiondirectory.org. This vulnerability was named CVE-2025-32807 since 04/10/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:geticon.php it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 251136 (Linux Distros Unpatched Vulnerability : CVE-2025-32807), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.5 eliminates this vulnerability. The upgrade is hosted for download at gitlab.fusiondirectory.org. Applying the patch 9edefd0b367450d665a141c5e94db8a06d208556 is able to eliminate this problem. The bugfix is ready for download at gitlab.fusiondirectory.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (251136). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• FusionDirectory

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion