CVE-2025-30005: Path Traversal in CompletePBX

The path traversal vulnerability in CompletePBX allows an attacker to bypass intended access controls and read any file accessible to the web server process. This includes sensitive configuration files, database credentials, and potentially even system files. The ability to delete files exacerbates the impact, allowing an attacker to disrupt services or even render the system unusable. A successful exploitation could lead to complete system compromise, data exfiltration, and denial of service. While no direct precedent is immediately apparent, path traversal vulnerabilities are frequently exploited to gain unauthorized access and control over systems.

1. Reserved2025-03-13
2. Published2025-03-31
3. Modified2025-12-27
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-30005 is to upgrade CompletePBX to version 5.2.36 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to the Diagnostics reporting module via a firewall or web application proxy. Configure your WAF to block requests containing suspicious path traversal patterns (e.g., '../'). Regularly monitor system logs for unusual file access or deletion activity. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file via the Diagnostics reporting module; the request should be denied.