CVE-2025-2292mediumCWE-22

CVE-2025-2292: medium-severity vulnerability in Xorcom CompletePBX

Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

Published · Updated

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.5epss 1.8%
from disclosure to weapon0 days
Published on NVDMar 31
metasploitMar 2
exploitation probability
1.8%top 23% of all CVEs
observed exploitation
nono source reports it
Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Xorcom · CompletePBX
Related CVEs — Xorcom CompletePBX

In the same product, most dangerous first.

CVE-2025-30004HIGHXorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command InjectionEPSS 4.2%CVE-2025-30005HIGHXorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File DeletionEPSS 1.8%CVE-2025-30006MEDIUMXorcom CompletePBX <= 5.2.35 Reflected Cross-Site ScriptingEPSS 0.2%
References
https://vulncheck.com/advisories/completepbx-file-disclosurehttps://www.xorcom.com/new-completepbx-release-5-2-36-1/