FreePBX CVE-2026-44239

Exploitation requires (1) network reachability to the FreePBX web administration interface, (2) a valid authenticated session at low privilege (PR:L in the CVSS vector - an unauthenticated request will not reach the vulnerable handler), (3) the Dashboard module being installed and enabled (it is enabled by default on standard FreePBX installs), and (4) the presence of a .class.php file on the filesystem whose top-level PHP code is useful to the attacker - this is the AT:P 'attack requirements present' factor and is almost always satisfied on a stock FreePBX server because of the many bundled module class files. Limiting factors: the PR:L requirement means anonymous internet scanners cannot exploit this directly, and the .class.php suffix appended by the include statement constrains which files can be targeted, so pure /etc/passwd-style disclosure is not the goal - the realistic outcome is PHP code execution by chaining traversal to an existing class file.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N) yields a 7.6 score reflecting a network-reachable, low-complexity attack that requires low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with arbitrary file inclusion leading to information disclosure and code execution within the web tier rather than service crash. EPSS and KEV signals are not supplied for this CVE, and there is no public exploit identified at time of analysis, so this should be treated as a real but not-yet-mass-exploited priority. The PR:L requirement materially limits the blast radius - an attacker needs at least a low-privileged FreePBX user session - but this is a meaningful concern for any FreePBX instance with self-service or operator accounts, weak credentials, or internet-exposed admin GUIs, which is unfortunately common. The AT:P (attack requirements present) flag suggests successful exploitation depends on the presence of suitable .class.php files reachable via traversal, which on a standard FreePBX install is almost certainly satisfied. A conflict to flag: the description's emphasis on file inclusion implies practical RCE potential, but the CVSS vector marks VA:N (no availability impact), so defenders should not assume DoS resilience automatically rules out destructive follow-on actions.

An attacker with any low-privileged FreePBX web account (for example, a basic operator login obtained via phishing, credential stuffing against an internet-exposed GUI, or a shared tenant account) sends a crafted POST to the Dashboard getcontent AJAX endpoint with rawname set to '../../../../path/to/attacker_controlled.class.php' or a writable system path. PHP resolves the traversal and include()s the target file, executing its top-level code in the FreePBX process before the class-not-found error surfaces, yielding arbitrary PHP execution and likely full read access to PBX configuration, SIP credentials, and call records. No public POC is currently identified, but the bug class is trivial to weaponize once an attacker locates a writable or attacker-influenced .class.php on the target.