MikoPBX - Path Traversal (CVE-2025-52207)

CVE-2025-52207 is a critical vulnerability in MikoPBX through version 2024.1.114 that allows authenticated attackers to upload arbitrary PHP scripts to any directory. This flaw can be exploited to achieve remote code execution, potentially leading to full system compromise, data theft, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-52207 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-52207 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-52207 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by uploading malicious PHP files via the /pbxcore/api/files/uploadFile endpoint, then accessing them through /pbxcore/files/cache/ to achieve remote code execution.