CVE-2025-13261: Lsfusion Platform Path Traversal Flaw

CVE-2025-13261 Overview

CVE-2025-13261 is a path traversal vulnerability [CWE-22] in the lsfusion platform through version 6.1. The flaw resides in the DownloadFileRequestHandler function within web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Attackers can manipulate the Version argument to traverse outside the intended directory and access unauthorized files. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public exploit details have been disclosed through the vendor's GitHub issue tracker, increasing the risk of active abuse against exposed instances.

Critical Impact
Unauthenticated remote attackers can read files outside the intended download directory by manipulating the Version parameter, exposing application data and configuration to disclosure.

Affected Products

lsfusion platform versions up to and including 6.1
Web client component (web-client module)
Deployments exposing the DownloadFileRequestHandler endpoint to untrusted networks

Discovery Timeline

2025-11-17 - CVE-2025-13261 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13261

Vulnerability Analysis

The vulnerability is a classic path traversal issue [CWE-22] in the lsfusion web-client component. The DownloadFileRequestHandler accepts a user-controlled Version argument and uses it to construct a file path without sufficient sanitization. Attackers can supply traversal sequences such as ../ to escape the intended directory and reference arbitrary files on the server file system. Because the endpoint is reachable over the network and requires no authentication, exploitation only requires crafting a malicious HTTP request. The impact is limited to confidentiality: successful exploitation discloses files readable by the lsfusion service account, including source artifacts, configuration data, and logs.

Root Cause

The root cause is missing input validation on the Version request parameter within DownloadFileRequestHandler.java. The handler concatenates or resolves the parameter against a base path without canonicalizing the result or verifying that the resolved path remains within the intended directory. Standard defenses such as rejecting .. sequences, using canonical path comparison, or mapping requests to an allow-list of file identifiers are absent.

Attack Vector

A remote attacker sends an HTTP request to the download endpoint and supplies a traversal payload in the Version argument. The server resolves the traversal, opens the target file, and returns its contents in the response. No credentials, tokens, or user interaction are required. The public disclosure in GitHub Issue #1543 provides sufficient detail for attackers to reproduce the request.

See the vendor tracker for reproduction specifics: lsfusion platform Issue #1543 and the associated VulDB entry #332596.

Detection Methods for CVE-2025-13261

Indicators of Compromise

HTTP requests to DownloadFileRequestHandler containing ../, ..%2f, or encoded traversal sequences in the Version parameter
Web server access logs showing successful 200 responses to download requests whose Version parameter references files outside the expected version directory structure
Unexpected outbound reads of sensitive files such as /etc/passwd, application configuration, or credential stores by the lsfusion service process

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Version parameter for path traversal patterns and encoded variants
Enable verbose access logging on the lsfusion web-client and alert on anomalous Version values that do not match expected version identifiers
Correlate HTTP request logs with file system audit events to identify reads outside the intended download directory

Monitoring Recommendations

Monitor for repeated DownloadFileRequestHandler requests originating from a single source with varying Version payloads
Track file access telemetry on the lsfusion server for reads of system files or files outside the application's data directories
Ingest web server and application logs into a centralized analytics platform for retroactive hunting once exploitation signatures are known

How to Mitigate CVE-2025-13261

Immediate Actions Required

Restrict network exposure of the lsfusion web-client to trusted networks or authenticated users until a patch is applied
Deploy WAF or reverse-proxy rules that reject requests containing traversal sequences in the Version parameter
Audit access logs for DownloadFileRequestHandler requests to identify prior exploitation attempts

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Track remediation status through the vendor's GitHub tracker: lsfusion platform Issue #1543 and the follow-up Issue Comment #3576922131. Upgrade to a fixed release once published by the maintainers.

Workarounds

Place the lsfusion web-client behind a reverse proxy that normalizes URLs and blocks traversal patterns before they reach the application
Run the lsfusion service under a low-privilege account with file system access limited to the required application directories
Apply operating system access controls to prevent the service account from reading sensitive configuration or credential files

bash

# Example nginx rule to block traversal payloads in the Version parameter
location /DownloadFileRequestHandler {
    if ($arg_Version ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://lsfusion_backend;
}