Path Traversal Vulnerability in ITCube CRM Software
CVE-2025-5993

9.2CRITICAL

Key Information:

Vendor

Itcube Software

Status
Itcube Crm
Vendor
CVE Published:
8 September 2025

What is CVE-2025-5993?

ITCube CRM, versions 2023.2 to 2025.2, is susceptible to a path traversal vulnerability that allows unauthenticated remote attackers to exploit the 'fileName' parameter. By crafting specific payloads, attackers may gain unrestricted access to download any file the web server can access, posing a significant security risk to data integrity.

Affected Version(s)

ITCube CRM 2023.2 <= 2025.2

References

https://cert.pl/posts/2025/07/CVE-2025-5993
third-party-advisory
https://itcube.pl/modul-crm
product

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrey Moerov (Possehl Secure GmbH)
.
CVE-2025-5993 : Path Traversal Vulnerability in ITCube CRM Software