CVE-2026-26978: CWE-502: Deserialization of Untrusted Data in FreePBX security-reporting
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.
AI Analysis
Technical Summary
The vulnerability CVE-2026-26978 in FreePBX's backup module arises from unsafe deserialization of untrusted data during backup restore operations. Specifically, when restoring from a user-supplied tar archive, malicious files can be unserialized without validation, enabling remote code execution under the web server user context. Exploitation requires authentication with a username that has write access to backup files or sufficient privileges. This issue affects FreePBX versions below 16.0.71 and versions from 17.0.0 up to but not including 17.0.6. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 4.0 score of 8.6, indicating high severity. The issue has been addressed in FreePBX versions 16.0.71 and 17.0.6.
Potential Impact
Successful exploitation allows an authenticated user with appropriate permissions to execute arbitrary code remotely as the web server user (typically asterisk or www-data). This can lead to full compromise of the affected system within the context of the web server process. No shell or CLI access is required beyond the normal backup restore workflow.
Mitigation Recommendations
This vulnerability has been fixed in FreePBX versions 16.0.71 and 17.0.6. Users should upgrade to these or later versions to remediate the issue. Until upgraded, restrict backup restore permissions to trusted users only. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified versions. Check the official FreePBX release notes or advisories for confirmation and further guidance.
CVE-2026-26978: CWE-502: Deserialization of Untrusted Data in FreePBX security-reporting
Description
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/freepbx/security-reportingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-26978 in FreePBX's backup module arises from unsafe deserialization of untrusted data during backup restore operations. Specifically, when restoring from a user-supplied tar archive, malicious files can be unserialized without validation, enabling remote code execution under the web server user context. Exploitation requires authentication with a username that has write access to backup files or sufficient privileges. This issue affects FreePBX versions below 16.0.71 and versions from 17.0.0 up to but not including 17.0.6. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 4.0 score of 8.6, indicating high severity. The issue has been addressed in FreePBX versions 16.0.71 and 17.0.6.
Potential Impact
Successful exploitation allows an authenticated user with appropriate permissions to execute arbitrary code remotely as the web server user (typically asterisk or www-data). This can lead to full compromise of the affected system within the context of the web server process. No shell or CLI access is required beyond the normal backup restore workflow.
Mitigation Recommendations
This vulnerability has been fixed in FreePBX versions 16.0.71 and 17.0.6. Users should upgrade to these or later versions to remediate the issue. Until upgraded, restrict backup restore permissions to trusted users only. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified versions. Check the official FreePBX release notes or advisories for confirmation and further guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-17T01:41:24.605Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0b82e3ec166c07b0fdb3ce
Added to database: 05/18/2026, 21:21:39 UTC
Last enriched: 05/26/2026, 08:22:01 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.