CVE-2025-59819 - Vulnerability Details - OpenCVE

This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zenitel	Alphacom Xe Audio Server

No data.

No data.

References

Link	Providers
https://wiki.zenitel.com/wiki/AlphaCom_13.02_-_Release_Notes
https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf

History

Mon, 23 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-22
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zenitel Zenitel alphacom Xe Audio Server
Vendors & Products		Zenitel Zenitel alphacom Xe Audio Server

Fri, 20 Feb 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.
Title		Authenticated Arbitrary File Read via filepath parameter
References		https://wiki.zenitel.com/wiki/AlphaCom_13.02_-_Release_Notes https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2026-02-20T07:58:57.686Z

Updated: 2026-02-23T18:06:05.759Z

Reserved: 2025-09-22T10:23:28.574Z

Link: CVE-2025-59819

Vulnrichment

Updated: 2026-02-23T18:05:52.876Z

NVD

Status : Awaiting Analysis

Published: 2026-02-20T08:17:02.057

Modified: 2026-02-23T19:22:56.197

Link: CVE-2025-59819

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59819", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "state": "PUBLISHED", "assignerShortName": "NCSC-NL", "dateReserved": "2025-09-22T10:23:28.574Z", "datePublished": "2026-02-20T07:58:57.686Z", "dateUpdated": "2026-02-23T18:06:05.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2026-02-20T07:58:57.686Z"}, "title": "Authenticated Arbitrary File Read via filepath parameter", "affected": [{"vendor": "zenitel", "product": "alphacom_xe_audio_server", "versions": [{"version": "*", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path."}], "references": [{"url": "https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf", "name": "Zenitel Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://wiki.zenitel.com/wiki/AlphaCom_13.02_-_Release_Notes", "name": "Zenitel Release Notes", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "LOW", "modifiedPrivilegesRequired": "LOW", "modifiedUserInteraction": "NONE", "modifiedScope": "UNCHANGED", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedAvailabilityImpact": "NONE", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T18:05:58.572199Z", "id": "CVE-2025-59819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T18:06:05.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T18:05:58.572199Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T18:05:52.876Z"}}], "cna": {"title": "Authenticated Arbitrary File Read via filepath parameter", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 6.5, "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 6.5, "privilegesRequired": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "LOW", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "zenitel", "product": "alphacom_xe_audio_server", "versions": [{"status": "affected", "version": "*", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf", "name": "Zenitel Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://wiki.zenitel.com/wiki/AlphaCom_13.02_-_Release_Notes", "name": "Zenitel Release Notes", "tags": ["release-notes"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path."}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2026-02-20T07:58:57.686Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59819", "state": "PUBLISHED", "dateUpdated": "2026-02-23T18:06:05.759Z", "dateReserved": "2025-09-22T10:23:28.574Z", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "datePublished": "2026-02-20T07:58:57.686Z", "assignerShortName": "NCSC-NL"}, "dataVersion": "5.2"}