What’s Vulnerable › Vulnerabilities
CVE-2025-1782: Unsanitized input in language form field
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-14 · updated 2026-08-06
- Weakness: CWE-94
Description
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.
Affected products
- Avantfax: before 3.4.1 — fixed in 3.4.1
- ifax HylaFAX: before 1.2.1; from 1.3.0 before 1.3.2 — fixed in 1.2.1, 1.3.2
How to fix
Upgrade to a fixed version: Avantfax 3.4.1; ifax HylaFAX 1.2.1, 1.3.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-1782 or the next vulnerability affects your stack