CVE-2025-1782

Unsanitized input in language form field

State: Published
Severity: 9.9 Critical
Published: Apr 14, 2025
Updated: Jul 27, 2026
Reserved: Feb 28, 2025

Description

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
HylaFAXifax	before 1.1.*Affected 1.2.0 to before 1.2.1Affected 1.3.0 to before 1.3.2Affected
AvantFAXifax	before 3.3.*Affected 3.4.0 to before 3.4.1Affected

References

https://www.ifax.com/security/CVE-2025-1782.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.