Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.3epss 1.8%
from disclosure to weapon0 days
Published on NVDMar 31
metasploitMar 2
exploitation probability
1.8%top 23% of all CVEs
observed exploitation
nono source reports it
Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report.
This issue affects CompletePBX: all versions up to and prior to 5.2.35
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected products
Xorcom · CompletePBX