CVE-2025-30005 | THREATINT

Description

Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report. This issue affects CompletePBX: all versions up to and prior to 5.2.35

Reserved 2025-03-13 | Published 2025-03-31 | Updated 2025-03-31 | Assigner VulnCheck

MEDIUM: 6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status

affected

Any version

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

vulncheck.com/...es/completepbx-path-traversal-file-deletion third-party-advisory

www.xorcom.com/new-completepbx-release-5-2-36-1/ vendor-advisory

cve.org (CVE-2025-30005)

nvd.nist.gov (CVE-2025-30005)

Download JSON