FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.
CVE-2026-54674 is an OS command injection vulnerability in FreePBX's security-reporting component affecting versions prior to 16.0.39 and 17.0.7. Authenticated users with access to the User Control Panel (UCP) can execute arbitrary commands as the webserver user due to insufficient sanitization of URL parameters. This vulnerability requires authenticated UCP access, which is more commonly granted to less-privileged users than to administrators. The issue has been addressed in FreePBX versions 16.0.39 and 17.0.7.
FreePBX versions prior to 16.0.4 and 17.0.6 contain a critical OS command injection vulnerability in the Music on Hold (MoH) module. Authenticated attackers with administrator privileges can inject arbitrary system commands via a POST parameter that defines a custom Asterisk application. This parameter is stored without sanitization and later written directly to the musiconhold_additional.conf configuration file, which Asterisk executes with its service privileges. The vulnerability has been patched in versions 16.0.4 and 17.0.6.
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
FreePBX backup versions prior to 17.0.11 contain a vulnerability in the publicKeySave AJAX endpoint that allows an authenticated administrator to append an SSH public key to the asterisk user's authorized_keys file without proper command restrictions. This grants persistent shell access with the ability to execute arbitrary commands, access sensitive data, modify system files, and disrupt services. The issue is fixed in version 17.0.11.
FreePBX missedcall module versions from 16.0.0 up to but not including 16.0.11 and from 17.0.0 up to but not including 17.0.4 contain an SQL injection vulnerability. The vulnerability arises because inbound Caller ID names from crafted SIP From headers are inserted into the missedcalllog database without proper escaping or use of bound parameters. This allows an unauthenticated attacker to inject SQL commands when a monitored extension goes unanswered, potentially corrupting the database and modifying administrator accounts to gain unauthorized remote access. The issue is fixed in versions 16.0.11 and 17.0.4.
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.
CVE-2026-73661 is a high-severity vulnerability in the FreePBX Framework module that allows an authenticated user with backup-restore or write access to crafted backup files to disable authentication during restoration. This occurs because the restore process permits restoring the hidden AUTHTYPE setting with the value 'none', bypassing the user interface's removal of this insecure setting. The issue affects FreePBX versions prior to 16.0.47 and 17.0.30 and is fixed in these versions.
FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.
CVE-2026-72578 is a high-severity cross-site request forgery (CSRF) vulnerability in FreePBX Framework version 17.0. It allows an unauthenticated remote attacker to perform administrative actions by exploiting the privileges of an authenticated administrator. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.
FreePBX versions prior to 17.0.8 contain a vulnerability in the api module's OAuth2 implementation where client credentials are not properly validated during token issuance. Specifically, the validateClient() method in ClientRepository.php always returns true, allowing an attacker who knows a valid client_id to obtain OAuth2 access tokens without the correct client_secret. This weakness enables unauthorized access to the system's OAuth2 tokens. The issue is fixed in version 17.0.8.
CVE-2026-44238 is a high-severity SQL injection vulnerability in the FreePBX CDR Reports module page. It affects versions prior to 16.0.50 and versions from 17.0.1 up to but not including 17.0.11. The vulnerability allows SQL injection via the order and sort POST parameters. Exploitation requires authentication with a FreePBX Administration Control Panel account that has access to the CDR section, but full administrator privileges are not necessary.
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
