FreePBX security-reporting versions before 16.0.22 and between 17.0.1 and 17.0.5 contain a remote file inclusion vulnerability (CWE-98) in the Dashboard module's getcontent AJAX handler. The handler uses the user-supplied $_REQUEST['rawname'] parameter directly in an include() call concatenated with a .class.php suffix without sanitizing the path. This allows path traversal attacks using ../ sequences to include arbitrary PHP class files from the filesystem, leading to execution of attacker-controlled PHP code before a class instantiation error occurs. The vulnerability has a CVSS 4.0 score of 7.6 (high severity) and is addressed by updates to versions 16.0.22 and 17.0.5.

An attacker with low privileges can exploit this vulnerability to include and execute arbitrary PHP files on the server, potentially leading to remote code execution within the context of the web application. This can compromise the confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

This vulnerability is fixed in FreePBX security-reporting versions 16.0.22 and 17.0.5. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, patching the affected software versions is required. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix is included in these versions.