CVE-2026-54675 is a critical path traversal vulnerability (CWE-22) in FreePBX security-reporting's sound language upload and conversion feature. Authenticated attackers with a known username can exploit insufficient path sanitization to write arbitrary files, including malicious PHP scripts, to the web server root directory. This arbitrary file write can lead directly to remote code execution. The vulnerability affects versions prior to 16.0.10 and 17.0.5 and has been addressed in these versions.

An authenticated attacker can exploit this vulnerability to write arbitrary files to the web server root directory, enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability requires authentication with a known username but no user interaction and has a high severity score of 8.7.

Upgrade FreePBX security-reporting to version 16.0.10 or later, or 17.0.5 or later, where this vulnerability has been patched. Applying these official fixes fully mitigates the risk of arbitrary file writes and remote code execution via this path traversal flaw.