lsfusion platform ZipUtils.java unpackFile path traversal

CVE-2025-13265: Path Traversal in lsfusion ZipUtils

The vulnerability resides in the unpackFile method of ZipUtils.java in the lsfusion platform up to version 6.1. The method fails to validate file names or symbolic links within a ZIP archive during extraction, allowing directory traversal sequences like ../ to escape the intended target directory [1][3].

Exploitation is possible remotely via MakeUnzipFileAction or the EmailReceiver component, both of which invoke the vulnerable unpackFile method. An attacker can craft a malicious ZIP archive containing entries with path traversal patterns, leading to file extraction outside the designated folder [3].

Successful exploitation enables arbitrary file overwrite and deletion on the server. This could be leveraged to overwrite critical system files or configuration, potentially resulting in code execution or denial of service [3].

Users should upgrade to lsfusion version newer than 6.1, as the vulnerability has been addressed in subsequent releases. No official workaround has been provided, but restricting access to affected actions may reduce risk.