Critical severity · published Apr 14, 2025
CVE-2025-1782
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the …
9.9
CVSS
0.6%
EPSS
No
On KEV
Description
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized
before being used and can be misused to include an arbitrary file in the
PHP code allowing an attacker to do anything as the web server user.
This flaw requires the attacker to be authenticated with a valid user account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Avantfax · Avantfax
before 3.4.1 · source: NVD
HY
Hylafax · Ifax
before 1.2.1; 1.3.0 before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1782
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1782
Mitigation
https://www.ifax.com/security/CVE-2025-1782.html
More from Avantfax
8.8
CVE-2023-23328
A File Upload vulnerability exists in AvantFAX 3.3.7
8.8
CVE-2020-11766
sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection
6.1
CVE-2017-18024
AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1
5.4
CVE-2023-23326
A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7
4.9
CVE-2023-23327
An Information Disclosure vulnerability exists in AvantFAX 3.3.7