Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2025-1782

Unsanitized input in language form field

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ifax HylaFAX

Default version status: unaffected

  • 0 to < 1.1.*affected
  • 1.2.0 to < 1.2.1affected
  • 1.3.0 to < 1.3.2affected

ifax AvantFAX

Default version status: unaffected

  • 0 to < 3.3.*affected
  • 3.4.0 to < 3.4.1affected

References