CVE-2025-2292

Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure

Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.

Affected

Xorcom · CompletePBX

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

1.75% chance of exploitation in the next 30 days, 78th percentile

Published

2025-03-31

Updated

2025-12-27

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/xorcom_completepbx…

Security advisories

• https://vulncheck.com/advisories/completepbx-file-disclosure
• https://www.xorcom.com/new-completepbx-release-5-2-36-1

References

• CVE Record
• NVD entry