ITCube CRM versions 2023.2–2025.2 contain an unauthenticated path traversal vulnerability…
ITCube CRM versions 2023.2–2025.2 contain an unauthenticated path traversal vulnerability (CVE-2025-5993) allowing arbitrary file downloads.
CERT Polska disclosed a path traversal vulnerability affecting ITCube CRM software versions 2023.2 through 2025.2. The vulnerability, tracked as CVE-2025-5993, resides in the fileName parameter and allows an unauthenticated remote attacker to construct malicious payloads that enable downloading arbitrary files accessible to the web server process. This represents a significant information disclosure risk as it requires no authentication and can expose sensitive configuration files, credentials, or application data.
The vulnerability was responsibly disclosed by Andrey Moerov from Possehl Secure GmbH, and CERT Polska coordinated the disclosure process. Organizations running affected ITCube CRM versions should prioritize patching, as the unauthenticated nature of the exploit lowers the barrier to entry for potential attackers.
Mentioned in this report
Detection guidance
ITCube CRM Path Traversal via fileName Parameter (CVE-2025-5993)
Detects HTTP requests containing directory traversal sequences in the fileName parameter, indicative of exploitation of CVE-2025-5993 in ITCube CRM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ITCube CRM Path Traversal via fileName Parameter
id: 0b34ec89-5897-567f-ac52-f504abf3db71
status: experimental
description: 'Detects unauthenticated path traversal attempts against ITCube CRM through
the vulnerable fileName parameter (CVE-2025-5993). Attackers embed encoded or literal
traversal sequences (../, ..%2f, %2e%2e/) in the fileName query string to read arbitrary
files accessible to the web server process.
'
references:
- CVE-2025-5993
logsource:
category: proxy
product: windows
detection:
selection:
c-uri|contains:
- fileName=
traversal:
c-uri|contains:
- ../
- ..%2f
- ..%2F
- '%2e%2e%2f'
- '%2e%2e/'
- ..\\
- ..%5c
condition: selection and traversal
fields:
- c-uri
- c-ip
- cs-method
- sc-status
falsepositives:
- Legitimate application requests that pass relative paths containing double dots
for non-malicious reasons (rare in well-formed CRM traffic)
- Automated vulnerability scanners testing the endpoint intentionally as part of authorized
security assessments
level: high
tags:
- attack.t1083
- attack.discovery
- cve.2025-5993
author: Vorant
ITCube CRM Sensitive File Access via Vulnerable fileName Endpoint
Detects successful HTTP responses to fileName parameter requests targeting sensitive OS/configuration files, suggesting data exfiltration via the ITCube CRM path traversal flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ITCube CRM Sensitive File Disclosure via fileName Endpoint
id: 247515bc-ee29-5e16-a65d-15e94ae15a9b
status: experimental
description: 'Detects HTTP requests to the ITCube CRM fileName parameter that reference
sensitive configuration or credential files (e.g. web.config, .env, /etc/passwd)
combined with a successful (2xx) server response, indicating potential data exfiltration
through CVE-2025-5993.
'
references:
- CVE-2025-5993
logsource:
category: proxy
product: windows
detection:
selection:
c-uri|contains: fileName=
sensitive_targets:
c-uri|contains:
- web.config
- .env
- passwd
- shadow
- appsettings.json
- database.yml
- id_rsa
- .git/config
success:
sc-status:
- 200
- 206
condition: selection and sensitive_targets and success
fields:
- c-uri
- c-ip
- sc-status
falsepositives:
- Internal monitoring or backup tools that legitimately request configuration files
through the same endpoint for asset inventory purposes
level: high
tags:
- attack.t1005
- attack.collection
- cve.2025-5993
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-5993
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free