CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-52207Public Exploit

MikoPBX - Path Traversal (CVE-2025-52207)

PublishedJun 27, 2025
First SeenN/A
Last Seen
Reported
CVSS9.9
M
MikoMikoPBX
php

Description

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.

psychologyCrowdSec Analysis

CVE-2025-52207 is a critical vulnerability in MikoPBX through version 2024.1.114 that allows authenticated attackers to upload arbitrary PHP scripts to any directory. This flaw can be exploited to achieve remote code execution, potentially leading to full system compromise, data theft, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-52207 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by uploading malicious PHP files via the /pbxcore/api/files/uploadFile endpoint, then accessing them through /pbxcore/files/cache/ to achieve remote code execution.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2025-06-27
Rule Released2025-09-24
CrowdSec First Seen2025-11-26

Related Weaknesses

CWE-23: Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References