Vulnerability · Published Sep 8, 2025 · Assigned by CERT-PL
CVE-2025-5993Path Traversal in ITCube CRM
Critical 9.2
In plain English
A critical-severity path traversal in ITCube CRM from ITCube Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ITCube Software | ITCube CRM | 2023.2 – through 2025.2 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
References
- https://cert.pl/posts/2025/07/CVE-2025-5993 third-party-advisory
- https://itcube.pl/modul-crm product