CVE-2025-52207: MikoPBX Path Traversal Vulnerability

CVE-2025-52207 Overview

A critical arbitrary file upload vulnerability exists in the PBXCoreREST/Controllers/Files/PostController.php component of MikoPBX through version 2024.1.114. This vulnerability allows an authenticated attacker to upload a malicious PHP script to an arbitrary directory on the server, which can lead to complete system compromise through remote code execution.

Critical Impact

Attackers can leverage this vulnerability to upload PHP web shells or malicious scripts to arbitrary directories, enabling full server takeover and potential lateral movement within the network.

Affected Products

• MikoPBX through version 2024.1.114
• PBXCoreREST/Controllers/Files/PostController.php component
• Systems exposing the MikoPBX REST API interface

Discovery Timeline

• 2025-06-27 - CVE-2025-52207 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2025-52207

Vulnerability Analysis

This vulnerability is classified as CWE-23 (Relative Path Traversal), enabling attackers to bypass intended directory restrictions during file upload operations. The vulnerable PostController.php file fails to properly sanitize the resumableIdentifier parameter, which is used to construct file paths during chunked file uploads. By manipulating this parameter with path traversal sequences (e.g., ../ or directory separators), an attacker can control where uploaded files are written on the server filesystem.

The network-accessible attack vector combined with low attack complexity makes this vulnerability particularly dangerous. An attacker with low-level privileges can exploit this flaw without any user interaction, potentially compromising not just the vulnerable system but affecting other resources in the same security scope.

Root Cause

The root cause lies in insufficient input validation of the resumableIdentifier parameter in the file upload controller. Prior to the patch, user-supplied input was directly used to construct file paths without proper sanitization, allowing directory traversal characters to escape the intended upload directory. The absence of character whitelisting and path normalization enabled attackers to specify arbitrary file locations.

Attack Vector

The attack leverages the chunked file upload mechanism in MikoPBX's REST API. An attacker can craft a malicious HTTP POST request containing:

1. A manipulated resumableIdentifier parameter with path traversal sequences (e.g., ../../var/www/html/shell)
2. A PHP payload disguised as a legitimate file chunk
3. The request targets the vulnerable PostController.php endpoint

Upon successful exploitation, the attacker's PHP script is written to the specified location, which can then be executed by accessing it via the web server.

                 'resumableTotalChunks' => $this->request->getPost('resumableTotalChunks'),
                 'resumableTotalSize'   => $this->request->getPost('resumableTotalSize'),
             ];
+
+            $identifier = preg_replace(['#[/\\\\]#','/\\.\\./'], ['',''], $data['resumableIdentifier'])??'';
+            $identifier = trim($identifier);
+            if (!preg_match('/^[a-zA-Z0-9_-]+$/', $identifier)) {
+                $this->sendError(Response::BAD_REQUEST, 'FILE Invalid identifier');
+                return;
+            }
+            if (strlen($identifier) > 255) {
+                $this->sendError(Response::BAD_REQUEST, 'FILE Identifier too long');
+                return;
+            }
+            $data['resumableIdentifier'] = $identifier;
+
             foreach ($this->request->getUploadedFiles() as $file) {
                 $data['files'][]= [
                     'file_path' => $file->getTempName(),

Source: GitHub Commit Details

Detection Methods for CVE-2025-52207

Indicators of Compromise

• Unexpected PHP files appearing in non-standard directories such as /var/www/html/ or web-accessible locations outside the designated upload folder
• Web server access logs showing POST requests to the file upload endpoint with unusual resumableIdentifier parameters containing ../ sequences or encoded path traversal characters
• New or modified PHP files with suspicious content such as eval(), base64_decode(), system(), or other shell execution functions
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Implement file integrity monitoring (FIM) on the MikoPBX web directories to detect unauthorized file creation or modification
• Configure web application firewall (WAF) rules to block requests containing path traversal patterns (../, ..%2f, %2e%2e/) in POST parameters
• Deploy endpoint detection rules to identify PHP files created outside designated upload directories
• Monitor web server logs for requests to the /pbxcore/api/files/ endpoints with suspicious parameter values

Monitoring Recommendations

• Enable verbose logging on the MikoPBX REST API to capture all file upload requests and their parameters
• Implement real-time alerting for any new PHP file creation in web-accessible directories
• Configure SIEM rules to correlate file upload events with subsequent web shell access patterns
• Regularly audit file permissions and ownership in MikoPBX installation directories

How to Mitigate CVE-2025-52207

Immediate Actions Required

• Update MikoPBX to the latest version that includes the security patch (commit 3ee785429d3f1b33c9ab387ef4221127c9b8c5f3)
• Audit all directories for unauthorized PHP files that may have been uploaded before patching
• Restrict network access to the MikoPBX REST API to trusted IP addresses only
• Review web server access logs for evidence of exploitation attempts

Patch Information

The vulnerability has been addressed in the MikoPBX Core repository. The patch implements comprehensive input validation for the resumableIdentifier parameter, including:

• Removal of forward slashes, backslashes, and parent directory references (../)
• Whitelisting to allow only alphanumeric characters, underscores, and hyphens
• Length validation limiting identifiers to 255 characters

Apply the patch by updating to the latest MikoPBX version. For detailed patch information, see the GitHub Commit Details.

Workarounds

• If immediate patching is not possible, implement WAF rules to block requests containing path traversal sequences in POST body parameters targeting the file upload endpoints
• Restrict file system permissions on the web server to prevent the PHP process from writing to directories outside the designated upload folder
• Disable or restrict access to the file upload API functionality until the patch can be applied
• Implement network segmentation to isolate MikoPBX instances from critical infrastructure

# Configuration example - Restrict access to MikoPBX API (nginx)
location /pbxcore/api/files/ {
    # Allow only trusted networks
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Additional security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
}