CVE-2025-1782: Unsanitized input in language form field
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.
Other sources
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1782?
CVE-2025-1782 has been assigned a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2025-1782?
To fix CVE-2025-1782, update your HylaFAX Enterprise Web Interface and AvantFAX to the latest version that includes the security patch.
What versions of software are affected by CVE-2025-1782?
CVE-2025-1782 affects HylaFAX Enterprise Web Interface and AvantFAX regardless of specific version numbers.
What is the impact of CVE-2025-1782?
The impact of CVE-2025-1782 is that it allows an attacker to execute arbitrary PHP code on the web server.
Who can exploit CVE-2025-1782?
CVE-2025-1782 can be exploited by any authenticated user interacting with the vulnerable forms in the web interface.