PT-2025-13801 · Xorcom · Xorcom Completepbx

Valentin Lobstein · Published 2025-03-31 · Updated 2025-12-27 · CVE-2025-2292

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xorcom CompletePBX versions through 5.2.35

Description The issue is an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.

Recommendations For versions through 5.2.35, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Backup and Restore functionality until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-2292

Affected Products

Xorcom Completepbx

References · 9

• https://osv.dev/vulnerability/CVE-2025-2292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2292 · Security Note
• https://xorcom.com/new-completepbx-release-5-2-36-1 · Vendor Advisory
• https://t.me/cvetracker/20368 · Telegram Post
• https://twitter.com/CVEnew/status/1906752622398492891 · Twitter Post
• https://vulncheck.com/advisories/completepbx-file-disclosure · Note
• https://t.me/cveNotify/146939 · Telegram Post
• https://twitter.com/Chocapikk_/status/1906794610279739752 · Twitter Post
• https://t.me/cvedetector/21646 · Telegram Post