CVE-2025-5993

CVE-2025-5993 is a path traversal vulnerability found in ITCube CRM versions 2023.2 through 2025.2. An unauthenticated remote attacker can exploit the vulnerable "fileName" parameter to construct payloads. This allows the attacker to download any file accessible by the web server process. Successful exploitation of CVE-2025-5993 could allow an attacker to access sensitive files on the server without authentication. This could lead to unauthorized information disclosure, potentially exposing critical system files, configuration details, or sensitive user data. To mitigate this vulnerability, it is recommended to update ITCube CRM to a version beyond 2025.2, implement strict input validation for file path parameters, restrict web server process file access using access controls, and monitor file access logs.