CVE-2025-5993CWE-22

Path Traversal in ITCube CRM

Critical · published September 8, 2025

CVSS v4.0
9.2
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-08T10:18Z
EPSS history
Timeline
  • 08 SEP 10:18Z
    Path Traversal in ITCube CRM
    cvelistv5