CVE-2025-25223: Luxcal Web Calendar Path Traversal Flaw

CVE-2025-25223 Overview

CVE-2025-25223 is a path traversal vulnerability in LuxCal Web Calendar affecting the dloader.php script. The flaw impacts LuxCal Web Calendar versions prior to 5.3.3M (MySQL edition) and prior to 5.3.3L (SQLite edition). Attackers can exploit this weakness to read arbitrary files from the underlying web server without authentication. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary files from the server, potentially exposing configuration files, database credentials, and application source code.

Affected Products

LuxCal Web Calendar (MySQL edition) prior to 5.3.3M
LuxCal Web Calendar (SQLite edition) prior to 5.3.3L
Luxsoft luxcal_web_calendar deployments exposing dloader.php

Discovery Timeline

2025-02-18 - CVE-2025-25223 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25223

Vulnerability Analysis

The vulnerability resides in the dloader.php script, which is intended to serve downloadable files from the LuxCal Web Calendar application. The script fails to properly sanitize user-supplied path parameters before using them to construct file system paths. Attackers can inject directory traversal sequences such as ../ to escape the intended download directory and reach arbitrary locations on the server.

Because the attack vector is network-based and requires no authentication or user interaction, any exposed LuxCal instance is reachable by remote actors. The impact is limited to confidentiality — attackers can read files but cannot modify them or degrade availability through this specific flaw. Sensitive targets typically include database configuration files, PHP source code, and web server credentials.

Root Cause

The root cause is improper input validation in the file-handling logic of dloader.php. The script trusts client-supplied filename parameters and appends them to a base directory without canonicalizing the resulting path or enforcing an allowlist of permitted files. This maps directly to [CWE-22], a classic path traversal weakness.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the dloader.php endpoint with a filename parameter containing directory traversal sequences. The web server, running as the PHP process user, resolves the path and returns the file contents in the HTTP response. Attackers commonly target files such as ../../../../etc/passwd on Linux hosts or LuxCal's own configuration files that store database credentials.

Refer to the JVN #26024080 Advisory and the Luxsoft Forum Discussion for additional technical context. No public proof-of-concept exploit code has been published at this time.

Detection Methods for CVE-2025-25223

Indicators of Compromise

HTTP requests to dloader.php containing traversal sequences such as ../, ..%2f, or encoded variants like %2e%2e%2f
Web server access logs showing successful 200 responses to dloader.php requests referencing files outside the LuxCal installation directory
Unexpected outbound access to LuxCal configuration files or sensitive OS paths correlated with external source IPs

Detection Strategies

Deploy web application firewall (WAF) rules that match traversal patterns targeting dloader.php request parameters
Review PHP and web server access logs for anomalous filename parameters passed to dloader.php
Alert on requests to dloader.php where response sizes deviate significantly from legitimate download baselines

Monitoring Recommendations

Baseline normal usage of dloader.php and alert on parameter values containing path separators or encoded traversal sequences
Monitor file system access telemetry on the web server for reads of sensitive files by the PHP worker process
Aggregate web access logs into a centralized platform and apply detection rules for [CWE-22] traversal patterns

How to Mitigate CVE-2025-25223

Immediate Actions Required

Upgrade LuxCal Web Calendar to version 5.3.3M (MySQL) or 5.3.3L (SQLite) or later immediately
Restrict network access to LuxCal instances from untrusted networks until patching is complete
Rotate any credentials or secrets stored in LuxCal configuration files that may have been exposed

Patch Information

Luxsoft has released fixed versions 5.3.3M for the MySQL edition and 5.3.3L for the SQLite edition. Administrators should download the updated builds from the Luxsoft Download Page and follow the vendor's upgrade instructions. Verify the deployed version after upgrade by checking the application's version identifier.

Workarounds

Remove or rename dloader.php if the download functionality is not required in your deployment
Restrict access to dloader.php via web server ACLs or authentication requirements enforced at the reverse proxy layer
Deploy WAF signatures that block traversal patterns and reject requests containing ../ or encoded equivalents against the LuxCal endpoint

bash

# Example nginx configuration to block traversal patterns against dloader.php
location ~ /dloader\.php$ {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    # Optional: require authentication at the proxy layer
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}