EUVD-2025-28139CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Tags
Description
A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and obtain sensitive information.
Analysis
CVE-2025-48026 is a path traversal vulnerability in the WebApl component of Mitel OpenScape Xpressions that allows unauthenticated attackers to read arbitrary files from the underlying operating system due to insufficient input validation. The vulnerability affects OpenScape Xpressions through version V7R1 FR5 HF43 P913, and successful exploitation could expose sensitive information without requiring authentication, elevated privileges, or user interaction. The CVSS 7.5 score reflects the high confidentiality impact, though integrity and availability are not affected.
Technical Context
The vulnerability exists in the WebApl component of Mitel OpenScape Xpressions, a unified communications platform. The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'), which indicates the application fails to properly validate and sanitize file path inputs before using them in file system operations. This allows attackers to use path traversal sequences (such as '../' or absolute paths) to navigate beyond intended directories and access arbitrary files on the system. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) or user interaction (UI:N), making it highly exploitable from a technical perspective. CPE identifiers would typically reference 'cpe:/a:mitel:openscape_xpressions' with version constraints through V7R1 FR5 HF43 P913.
Affected Products
OpenScape Xpressions (Through V7R1 FR5 HF43 P913)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today