2018-03-04 02:29:00 2018-03-29 00:00:29

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.