CVE-2025-1782·PHP vulnerability
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbitrary file in the PHP code allowing an attacker to do anything as the web server user. This flaw requires the attacker to be authenticated with a valid user account.
- Severity
- critical
- Software
- PHP
- Fixed in
- 1.3.2
- Published
- 2025-04-14
Affected versions
From: 1.3.0
Until: 1.3.2
Fixed in: 1.3.2
How to fix this CVE
Update PHP to version 1.3.2 or later immediately, as this critical vulnerability allows authenticated attackers to execute arbitrary code through improper sanitization of the language parameter. The flaw enables local file inclusion (LFI) attacks that can compromise your entire web server. Verify the patch is applied by checking your PHP version and restarting web services after the update.
sudo dnf update phpDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST|GET.*language=.*(?:\.\.[\/\\]|file://|data://|php://|expect://|base64_encode\(|include\(|require\()WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement a WAF rule to block requests with the language parameter containing path traversal sequences (../, ..\, encoded variants like %2e%2e%2f), URI schemes (file://, php://, data://), or PHP function calls. Example: Block if 'language' parameter matches regex: `(\.\.[\/\\]|file://|php://|data://|include|require)`How to check if you are affected
- Step 1: Check your PHP version with `php -v` and compare against version 1.3.2
- Step 2: Verify the vulnerable language parameter handling by checking web server error logs for LFI attempts (look for paths like `../` or file:// URIs in GET/POST parameters)
- Step 3: Search web server access logs for requests containing `language=` parameter with path traversal sequences: `grep -i 'language=.*\.\./' /var/log/apache2/access.log` or equivalent nginx log path
- Step 4: Confirm the fix by running `php -v` again and verifying the version is 1.3.2 or higher, then restart PHP-FPM with `sudo systemctl restart php-fpm`
FAQ
What is CVE-2025-1782?
This critical PHP vulnerability involves improper input sanitization of the language form parameter, allowing authenticated users to inject arbitrary file includes that execute with web server privileges, leading to complete system compromise.
Is CVE-2025-1782 being actively exploited?
No, according to CISA KEV data and available threat intelligence, this vulnerability is not currently being actively exploited in the wild, though it should be prioritized due to its critical severity and low attack complexity.
What versions of PHP are affected by CVE-2025-1782?
PHP versions 1.3.0 through 1.3.2 are affected; version 1.3.2 contains the fix, so ensure you are running 1.3.2 or later.
How do I check if my server is vulnerable to CVE-2025-1782?
Run `php -v` to display your PHP version. If the output shows version 1.3.0, 1.3.1, or 1.3.2 (or earlier), your system is vulnerable and requires immediate patching.
Does Defensia detect CVE-2025-1782?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2025-1782 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-1782. Free for 1 server.
Get started free