Which versions of FreePBX are affected by CVE-2026-44239?

FreePBX versions prior to 16.0.22 and 17.0.5 contain a file inclusion vulnerability in the Dashboard module that allows authenticated attackers to execute arbitrary code on the telephony system.. A patch is available.

How to fix or mitigate CVE-2026-44239?

Within 24 hours: inventory deployed FreePBX versions and identify systems running versions prior to 16.0.22 (supported branch) or 17.0.5 (newer branch). Within 7 days: restrict Dashboard module network access to authorized administrators only via firewall rules; enforce strong password policies on all FreePBX accounts. Within 30 days: monitor vendor advisories for patch release; prepare upgrade plan to patched versions once available.

FreePBX CVE-2026-44239

Q: What is the CVSS score of CVE-2026-44239?

CVE-2026-44239 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33297 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-29 GitHub_M

LFI PHP Path Traversal

7.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 15:01 EUVD

Analysis Generated

May 29, 2026 - 14:32 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.6 (HIGH)

DescriptionGitHub Advisory

FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.

AnalysisAI

Local file inclusion in FreePBX versions prior to 16.0.22 and 17.0.5 allows authenticated remote attackers to include arbitrary .class.php files from the filesystem via path traversal in the Dashboard module's getcontent AJAX handler. The unsanitized $_REQUEST['rawname'] parameter is concatenated into a PHP include() call, and any included file's top-level code executes before the subsequent class instantiation fails. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but CWE-98 PHP file inclusion bugs are historically high-value targets in PBX systems exposed to the internet.

Technical ContextAI

FreePBX is a widely deployed open-source web GUI built on top of Asterisk for managing IP PBX deployments, written predominantly in PHP. The vulnerability resides in the Dashboard module's getcontent AJAX endpoint, which constructs a dynamic include path by appending a '.class.php' suffix to user-supplied input from $_REQUEST['rawname'] without canonicalization or whitelist validation. This is a textbook CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) issue: because '../' sequences are not stripped, an attacker can traverse outside the intended class directory and force PHP to require() any file on disk whose name ends in .class.php, with that file's top-level statements running in the FreePBX process context. The fix lines (16.0.22 and 17.0.5) and the CPE identifier cpe:2.3:a:freepbx:security-reporting indicate the patch landed through the FreePBX security-reporting repository, with the upstream advisory tracked at GHSA-hw7v-v2jp-wc4v.

RemediationAI

Vendor-released patch: upgrade to FreePBX 16.0.22 or 17.0.5 (or later) per the GitHub Security Advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hw7v-v2jp-wc4v, which removes the unsanitized include in the Dashboard module's getcontent handler. If patching cannot be applied immediately, compensating controls include restricting access to the FreePBX administrative web UI behind a VPN or IP allowlist so the AJAX endpoint is not reachable from untrusted networks, tightening web-user account hygiene (rotate credentials, disable unused low-privileged accounts since exploitation requires PR:L), and adding a WAF or reverse-proxy rule that blocks requests to the dashboard getcontent endpoint containing '../' or encoded traversal sequences in the rawname parameter - note this rule may break legitimate dashboard widgets that pass module names, so test before enforcing. Disabling the Dashboard module is a heavier mitigation that removes the attack surface entirely but degrades the operator experience and is generally only viable for headless deployments.