CVE-2025-13265 is a medium severity path traversal (CVSS 6.3) in lsFusion platform up to version 6.1. The weak spot is the unpackFile function in ZipUtils.java, which handles archive extraction. The record names no fixed release, so check the project issue and upgrade past 6.1.
What's affected
The affected product is the lsFusion platform, versions up to 6.1. The record places the flaw in the function unpackFile of server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. The record says the manipulation causes path traversal, and that the issue can be started remotely.
No fixed version is named. The report is tracked in the project as issue 1545. I could not load that page while preparing this post, so check it and the release notes for the first fixed version. This is a sibling of CVE-2025-13262, which hits a different part of the same platform.
The weakness is CWE-22. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so a low privilege account is needed. The kev flag is false.
How to check if you're exposed
Work out your lsFusion version first. Look at the deployed archives or at your build file:
find / -iname "*lsfusion*" \( -name "*.jar" -o -name "*.war" \) 2>/dev/null
grep -rn "lsfusion" pom.xml build.gradle 2>/dev/null
If you run 6.1 or lower, you are in the affected range. Next, find out whether your application unpacks archives that come from users or from outside systems. If every archive is produced internally and never touched by outsiders, your practical exposure is lower. If users can upload or import archives, treat it as live.
What to do now
- Inventory every lsFusion instance and its version.
- Check the project issue and release notes, and upgrade past 6.1 as soon as a fixed release is confirmed.
- Until then, restrict who can import or upload archives to the platform.
- Run the server process with the least file system rights it needs.
- Keep backups of files outside the application folders, in case a bad extraction overwrites something.
- Review recent archive imports for entries with unusual file names.
- Re-check the version after the upgrade and note the date.
Why it matters
Archive extraction is a well known source of path traversal. Each entry in an archive carries a name, and if the extractor joins that name onto a target folder without checking where the result lands, a name with parent directory markers can place a file outside the folder. The same weakness class, CWE-22, applies. The safe pattern is to resolve each target path and confirm it stays under the destination before writing.
The score is medium because a low privilege account is needed and each impact is rated low. Still, being able to write files in unexpected places can matter more than the number suggests, especially on a server that runs code from disk.
Quick check
How is this different from CVE-2025-13262?
Both are path traversal flaws in lsFusion platform up to 6.1. This one is in archive extraction and needs a low privilege account. CVE-2025-13262 is in the upload request handler and needs no login.
Should I stop accepting archives?
If you cannot confirm a fixed version yet, limiting who can supply archives is a sensible stopgap.
Sources
- Safeguard Gold entry for CVE-2025-13265
- https://github.com/lsfusion/platform/issues/1545
- https://vuldb.com/?ctiid.332600
- https://vuldb.com/?id.332600
- https://vuldb.com/?submit.689427
Last reviewed: 19 October 2026.
