CVE-2022-25336: Ibexa Ez Platform Kernel

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.

Affected products

• Ibexa Ez Platform Kernel: from 1.3.0, before 1.3.12 (fixed in 1.3.12); from 7.5.0, before 7.5.26 (fixed in 7.5.26)

Published 2022-02-18. Last modified 2026-06-17.