ITCube CRM unauthenticated path traversal enables file downloads
ITCube CRM versions 2023.2–2025.2 contain an unauthenticated path traversal vulnerability (CVE-2025-5993) allowing arbitrary file downloads.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed a path traversal vulnerability affecting ITCube CRM software versions 2023.2 through 2025.2. The vulnerability, tracked as CVE-2025-5993, resides in the fileName parameter and allows an unauthenticated remote attacker to construct malicious payloads that enable downloading arbitrary files accessible to the web server process. This represents a significant information disclosure risk as it requires no authentication and can expose sensitive configuration files, credentials, or application data.
The vulnerability was responsibly disclosed by Andrey Moerov from Possehl Secure GmbH, and CERT Polska coordinated the disclosure process. Organizations running affected ITCube CRM versions should prioritize patching, as the unauthenticated nature of the exploit lowers the barrier to entry for potential attackers.
Mentioned in this report
Detection guidance
ITCube CRM Path Traversal via fileName Parameter (CVE-2025-5993)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing directory traversal sequences in the fileName parameter, indicative of exploitation of CVE-2025-5993 in ITCube CRM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ITCube CRM Path Traversal via fileName Parameter
id: 0b34ec89-5897-567f-ac52-f504abf3db71
status: experimental
description: 'Detects unauthenticated path traversal attempts against ITCube CRM through
the vulnerable fileName parameter (CVE-2025-5993). Attackers embed encoded or literal
traversal sequences (../, ..%2f, %2e%2e/) in the fileName query string to read arbitrary
files accessible to the web server process.
'
references:
- CVE-2025-5993
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- fileName=
traversal:
c-uri|contains:
- ../
- ..%2f
- ..%2F
- '%2e%2e%2f'
- '%2e%2e/'
- ..\\
- ..%5c
condition: selection and traversal
fields:
- c-uri
- c-ip
- cs-method
- sc-status
falsepositives:
- Legitimate application requests that pass relative paths containing double dots
for non-malicious reasons (rare in well-formed CRM traffic)
- Automated vulnerability scanners testing the endpoint intentionally as part of authorized
security assessments
level: high
tags:
- attack.t1083
- attack.discovery
- cve.2025-5993
author: Vorant
ITCube CRM Sensitive File Access via Vulnerable fileName Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects successful HTTP responses to fileName parameter requests targeting sensitive OS/configuration files, suggesting data exfiltration via the ITCube CRM path traversal flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ITCube CRM Sensitive File Disclosure via fileName Endpoint
id: 247515bc-ee29-5e16-a65d-15e94ae15a9b
status: experimental
description: 'Detects HTTP requests to the ITCube CRM fileName parameter that reference
sensitive configuration or credential files (e.g. web.config, .env, /etc/passwd)
combined with a successful (2xx) server response, indicating potential data exfiltration
through CVE-2025-5993.
'
references:
- CVE-2025-5993
logsource:
category: proxy
detection:
selection:
c-uri|contains: fileName=
sensitive_targets:
c-uri|contains:
- web.config
- .env
- passwd
- shadow
- appsettings.json
- database.yml
- id_rsa
- .git/config
success:
sc-status:
- 200
- 206
condition: selection and sensitive_targets and success
fields:
- c-uri
- c-ip
- sc-status
falsepositives:
- Internal monitoring or backup tools that legitimately request configuration files
through the same endpoint for asset inventory purposes
level: high
tags:
- attack.t1005
- attack.collection
- cve.2025-5993
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-5993
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs