CVE-2025-30005

CVE-2025-30005 is a critical path traversal vulnerability affecting Xorcom CompletePBX, specifically all versions up to and prior to 5.2.35. This flaw in the Diagnostics reporting module allows authenticated attackers to read arbitrary files on the system and, alarmingly, delete those retrieved files. The vulnerability carries a high CVSS score of 8.3, indicating a significant risk due to its low attack complexity, requiring only low privileges for a network-based attack. The potential impact includes high confidentiality and integrity compromise, with a lower availability impact. While not yet listed in CISA's KEV catalog, exploit intelligence shows a Metasploit module exists for arbitrary file read and deletion, suggesting readily available exploit code. The vulnerability has garnered significant community discussion, with 10 mentions, indicating high awareness among security researchers.