CVE-2025-30005CWE-22

Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion

High · published March 31, 2025

CVSS v3.1
8.3
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report.

This issue affects CompletePBX: all versions up to and prior to 5.2.35

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.01845 · 78.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-03-31T16:45Z
EPSS history
Timeline
  • 31 MAR 16:45Z
    Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion
    cvelistv5