MikoPBX - Path Traversal (CVE-2025-52207)

CVE-2025-52207 is a critical vulnerability in MikoPBX through version 2024.1.114 that allows authenticated attackers to upload arbitrary PHP scripts to any directory. This flaw can be exploited to achieve remote code execution, potentially leading to full system compromise, data theft, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-52207 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-52207 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by uploading malicious PHP files via the /pbxcore/api/files/uploadFile endpoint, then accessing them through /pbxcore/files/cache/ to achieve remote code execution.