CVE-2025-5993

9.2 criticalEPSS 0.6%

Critical (9.2). EPSS 0.6% chance of exploitation in the next 30 days.

ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-09-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cert.pl/posts/2025/07/CVE-2025-5993
https://itcube.pl/modul-crm

Check your stack JSON