CVE-2025-2292 - Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

Back Back to CVE browser

MEDIUM

Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

Published Mar 31, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 1.75%

Description

Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.

Affected products

Vendor Xorcom Product CompletePBX Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=5.2.35

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xorcom

CompletePBX

unaffected

Version	Status	Constraints
0	affected	<=5.2.35

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://vulncheck.com/advisories/completepbx-file-disclosure
third-party-advisoryThird Party Advisory
https://www.xorcom.com/new-completepbx-release-5-2-36-1/
vendor-advisoryRelease Notes

Link	Providers	Tags
https://vulncheck.com/advisories/completepbx-file-disclosure		third-party-advisoryThird Party Advisory
https://www.xorcom.com/new-completepbx-release-5-2-36-1/		vendor-advisoryRelease Notes