CVE-2025-30005

Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion

Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report.This issue affects CompletePBX: all versions up to and prior to 5.2.35

Affected

Xorcom · CompletePBX

CVSS v3.1 NVD

8.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS

1.85% chance of exploitation in the next 30 days, 79th percentile

Published

2025-03-31

Updated

2025-12-27

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/xorcom_completepbx…

Security advisories

• https://vulncheck.com/advisories/completepbx-path-traversal-file-deletion
• https://www.xorcom.com/new-completepbx-release-5-2-36-1

References

• CVE Record
• NVD entry