CVE-2025-2292CWE-22

Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

Medium · published March 31, 2025

CVSS v3.1
6.5
EPSS
2%
Percentile
77.7
In the wild
Unconfirmed
What it is

Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01750 · 77.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-03-31T16:38Z
EPSS history
Timeline
  • 31 MAR 16:38Z
    Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure
    cvelistv5