CVE-2026-54674: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in FreePBX security-reporting
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often more common for less-privileged users to have UCP access vs. the Administrator Control Panel (ACP) access (which is usually FreePBX higher-level administrator accounts only). Insufficient sanitization of certain URL parameters utilized by UCP did not fully account for malicious strings in these fields. This could result in binaries being executed on the host server by carefully chaining commands. This issue has been patched in versions 16.0.39 and 17.0.7.
AI Analysis
Technical Summary
FreePBX versions before 16.0.39 and 17.0.7 contain an OS command injection vulnerability (CWE-78) in the security-reporting module. Authenticated users accessing the User Control Panel can exploit insufficient sanitization of URL parameters to execute arbitrary OS commands as the webserver user (typically 'asterisk'). This allows command execution on the host server by chaining commands within specially crafted HTTP requests. The vulnerability requires authenticated UCP access but does not require administrator privileges. The flaw has been addressed in FreePBX versions 16.0.39 and 17.0.7.
Potential Impact
An attacker with authenticated access to the User Control Panel can execute arbitrary commands on the PBX server with the privileges of the webserver user. This could lead to unauthorized control over the PBX system, potentially compromising call handling, data confidentiality, and system integrity. The vulnerability does not require administrator-level access but does require valid UCP credentials. No known exploits in the wild have been reported as of the publication date.
Mitigation Recommendations
This vulnerability has been officially fixed in FreePBX versions 16.0.39 and 17.0.7. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, patching the affected software is required. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-54674: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in FreePBX security-reporting
Description
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often more common for less-privileged users to have UCP access vs. the Administrator Control Panel (ACP) access (which is usually FreePBX higher-level administrator accounts only). Insufficient sanitization of certain URL parameters utilized by UCP did not fully account for malicious strings in these fields. This could result in binaries being executed on the host server by carefully chaining commands. This issue has been patched in versions 16.0.39 and 17.0.7.
CVSS v4.0
Score 8.6high
Affected software
FreePBX
security-reporting
pkg:github/freepbx/security-reportingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreePBX versions before 16.0.39 and 17.0.7 contain an OS command injection vulnerability (CWE-78) in the security-reporting module. Authenticated users accessing the User Control Panel can exploit insufficient sanitization of URL parameters to execute arbitrary OS commands as the webserver user (typically 'asterisk'). This allows command execution on the host server by chaining commands within specially crafted HTTP requests. The vulnerability requires authenticated UCP access but does not require administrator privileges. The flaw has been addressed in FreePBX versions 16.0.39 and 17.0.7.
Potential Impact
An attacker with authenticated access to the User Control Panel can execute arbitrary commands on the PBX server with the privileges of the webserver user. This could lead to unauthorized control over the PBX system, potentially compromising call handling, data confidentiality, and system integrity. The vulnerability does not require administrator-level access but does require valid UCP credentials. No known exploits in the wild have been reported as of the publication date.
Mitigation Recommendations
This vulnerability has been officially fixed in FreePBX versions 16.0.39 and 17.0.7. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, patching the affected software is required. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T22:53:58.560Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abab9fff7a7c54106139f11
Added to database: 09/28/2026, 19:03:27 UTC
Last enriched: 09/28/2026, 19:17:40 UTC
Last updated: 09/29/2026, 02:48:24 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.