CVE-2025-59819

CVE-2025-59819 describes an arbitrary file read vulnerability in AlphaCom XE, where an authenticated attacker can change a filepath parameter to an internal system path, allowing access to files outside the intended scope. This flaw stems from insufficient validation of user-supplied input in file handling operations.

Exploitation requires authentication to the AlphaCom system, but no special privileges beyond standard user access. The attacker can modify the filepath parameter in a request, leading the application to read and return arbitrary files from the server's filesystem. No additional attack vectors or network prerequisites are specified beyond being able to make authenticated requests.

An attacker exploiting this vulnerability could read sensitive information, such as configuration files, credentials, or other confidential data stored on the system. This could lead to further compromise or information disclosure.

The vendor addressed this issue in AlphaCom 13.2.3.16, as noted in the release notes under bug fix MTN-4808: 'Fixed arbitrary file read issue' [1]. Users should upgrade to this version or later to mitigate the vulnerability.