CVE-2025-13262: High Path Traversal in lsFusion Platform Upload Handler

CVE-2025-13262 is a high severity path traversal flaw (CVSS 7.3) in lsFusion platform up to version 6.1. It sits in UploadFileRequestHandler and is reached through the sid argument. The record names no fixed release, so check the project issue and upgrade past 6.1 when one is available.

What's affected

The affected product is the lsFusion platform, versions up to 6.1. The record points to the function UploadFileRequestHandler in platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Changing the sid argument leads to path traversal, so the web client's upload handler can be tricked into working with a file path outside the folder it is meant to use.

The record does not state a fixed version. The project tracked the report as issue 1544 on GitHub. Check that issue and the project's release notes before you record the CVE as remediated. I could not load the issue page while preparing this post, so I am not quoting anything from it.

The weakness is CWE-22. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with low impact on each of confidentiality, integrity and availability. The kev flag is false, though the record says the exploit has been publicly disclosed.

How to check if you're exposed

Find out which lsFusion version you run. If you deploy the web client as a Java application, look at the file name of the deployed archive or the version shown in the admin or about page.

# find lsFusion jars or wars on a host and show their names
find / -iname "*lsfusion*" \( -name "*.jar" -o -name "*.war" \) 2>/dev/null

If you build the platform into your own project, check the dependency declaration in your build file for the lsFusion version and compare it with 6.1.

grep -rn "lsfusion" pom.xml build.gradle 2>/dev/null

Anything at 6.1 or lower is in range. Reachability matters too: if the web client with its upload endpoint is not exposed beyond a trusted network, urgency drops, though the flaw is still worth closing.

What to do now

1. Inventory every lsFusion deployment, including test systems.
2. Read the project issue and the release notes for the first version that addresses it, and confirm before you plan the upgrade.
3. Upgrade past 6.1 once a fixed release is confirmed.
4. Until then, limit who can reach the web client upload feature, using a VPN, IP allow list or reverse proxy rule.
5. Run the application under an account that can write only to the directories it needs, so a bad path cannot reach system files.
6. Review upload and application logs for session identifier values that contain path separators or parent directory markers.
7. Re-scan the dependency after the upgrade to confirm the version moved.

Why it matters

Path traversal, CWE-22, happens when an application builds a file path from outside input without making sure the result stays inside the intended folder. Values that contain parent directory markers can then point somewhere else on the disk. The normal defence is to resolve the final path and check that it still sits under the allowed base directory, and to reject input that carries path separators when it should be a plain identifier.

In this case the argument is called sid, which sounds like a session or identifier value rather than a path. Treating an identifier as a path piece without checking it is a common way this bug appears. The impacts are rated low individually, but read, write and delete powers on files can add up depending on what lives on the server.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-13262
• https://github.com/lsfusion/platform/issues/1544
• https://github.com/lsfusion/platform/issues/1544#issue-3589610731
• https://vuldb.com/?ctiid.332597
• https://vuldb.com/?id.332597

Last reviewed: 19 October 2026.