by Kastro
Paper/Archive/CVE-2025-5993

CVE-2025-5993

ITCube Software ITCube CRM — Path Traversal in ITCube CRM

EPSS 0.6%CVSS 9.2
critical.is priorityof 100
37
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 48.9.489 × 209.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.

Affected

ProductAffectedFixed inSource
ITCube CRM2023.2 – 2025.2–CNA

Scores by source

CERT-PL (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupcert.pl/posts/2025/07/CVE-2025-5993refitcube.pl/modul-crm