CyberSecBulletin

Lsfusion vulnerabilities

We track 2 vulnerabilities in Lsfusion products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 17, 2025.

2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score

Latest Lsfusion vulnerabilities

  • 9.1 Critical severity

    platform: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2025-13265Lsfusion

    A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal.

  • 9.8 Critical severity

    platform: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2025-13262Lsfusion

    A vulnerability was determined in lsfusion platform up to 6.1. Affected by this vulnerability is the function UploadFileRequestHandler of the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Executing manipula