# ITCube CRM versions 2023.2–2025.2 contain an unauthenticated path traversal vulnerability…

Published: 2025-09-08 · Severity: high
Canonical: https://vorant.io/reports/fde0b391-b1a9-4c58-bbf8-4c6a60e909b7/itcube-crm-versions-2023-2-2025-2-contain-an-unauthenticated-path-traversal

> ITCube CRM versions 2023.2–2025.2 contain an unauthenticated path traversal vulnerability (CVE-2025-5993) allowing arbitrary file downloads.

CERT Polska disclosed a path traversal vulnerability affecting ITCube CRM software versions 2023.2 through 2025.2. The vulnerability, tracked as CVE-2025-5993, resides in the fileName parameter and allows an unauthenticated remote attacker to construct malicious payloads that enable downloading arbitrary files accessible to the web server process. This represents a significant information disclosure risk as it requires no authentication and can expose sensitive configuration files, credentials, or application data.

The vulnerability was responsibly disclosed by Andrey Moerov from Possehl Secure GmbH, and CERT Polska coordinated the disclosure process. Organizations running affected ITCube CRM versions should prioritize patching, as the unauthenticated nature of the exploit lowers the barrier to entry for potential attackers.

## Mentioned in this report

- Vulnerabilities: CVE-2025-5993

## Detection guidance (public sample)

### ITCube CRM Path Traversal via fileName Parameter (CVE-2025-5993)

ATT&CK: T1083

Detects HTTP requests containing directory traversal sequences in the fileName parameter, indicative of exploitation of CVE-2025-5993 in ITCube CRM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ITCube CRM Path Traversal via fileName Parameter
id: 0b34ec89-5897-567f-ac52-f504abf3db71
status: experimental
description: 'Detects unauthenticated path traversal attempts against ITCube CRM through
  the vulnerable fileName parameter (CVE-2025-5993). Attackers embed encoded or literal
  traversal sequences (../, ..%2f, %2e%2e/) in the fileName query string to read arbitrary
  files accessible to the web server process.

  '
references:
- CVE-2025-5993
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - fileName=
  traversal:
    c-uri|contains:
    - ../
    - ..%2f
    - ..%2F
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..\\
    - ..%5c
  condition: selection and traversal
fields:
- c-uri
- c-ip
- cs-method
- sc-status
falsepositives:
- Legitimate application requests that pass relative paths containing double dots
  for non-malicious reasons (rare in well-formed CRM traffic)
- Automated vulnerability scanners testing the endpoint intentionally as part of authorized
  security assessments
level: high
tags:
- attack.t1083
- attack.discovery
- cve.2025-5993
author: Vorant
```

### ITCube CRM Sensitive File Access via Vulnerable fileName Endpoint

ATT&CK: T1005

Detects successful HTTP responses to fileName parameter requests targeting sensitive OS/configuration files, suggesting data exfiltration via the ITCube CRM path traversal flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ITCube CRM Sensitive File Disclosure via fileName Endpoint
id: 247515bc-ee29-5e16-a65d-15e94ae15a9b
status: experimental
description: 'Detects HTTP requests to the ITCube CRM fileName parameter that reference
  sensitive configuration or credential files (e.g. web.config, .env, /etc/passwd)
  combined with a successful (2xx) server response, indicating potential data exfiltration
  through CVE-2025-5993.

  '
references:
- CVE-2025-5993
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains: fileName=
  sensitive_targets:
    c-uri|contains:
    - web.config
    - .env
    - passwd
    - shadow
    - appsettings.json
    - database.yml
    - id_rsa
    - .git/config
  success:
    sc-status:
    - 200
    - 206
  condition: selection and sensitive_targets and success
fields:
- c-uri
- c-ip
- sc-status
falsepositives:
- Internal monitoring or backup tools that legitimately request configuration files
  through the same endpoint for asset inventory purposes
level: high
tags:
- attack.t1005
- attack.collection
- cve.2025-5993
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2025/09/CVE-2025-5993

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fde0b391-b1a9-4c58-bbf8-4c6a60e909b7/itcube-crm-versions-2023-2-2025-2-contain-an-unauthenticated-path-traversal.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup