CVE-2025-2292

6.5 mediumEPSS 1.8%

Medium (6.5) in xorcom completepbx. EPSS 1.8% chance of exploitation in the next 30 days.

Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-03-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xorcom:completepbx

References

https://vulncheck.com/advisories/completepbx-file-disclosure
https://www.xorcom.com/new-completepbx-release-5-2-36-1/

Check your stack JSON