FreePBX CVE-2026-54674

Requires an authenticated User Control Panel (UCP) session on FreePBX versions prior to 16.0.39 or 17.0.7 - any low-privilege account suffices, and the advisory notes UCP access is frequently granted to non-administrator users (unlike the more restricted Administrator Control Panel). Exploitation is performed remotely over HTTP by placing malicious strings in specific UCP URL parameters that are insufficiently sanitized, allowing command chaining. Limiting factors: valid UCP credentials are needed (PR:L), the PBX web interface must be network-reachable to the attacker, and the affected version must be running; no user interaction from a victim is required.

This is a genuine high-priority issue for exposed FreePBX systems. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) describes network-reachable, low-complexity OS command injection (CWE-78) requiring only low-privilege authentication - and the description explicitly notes UCP access is commonly granted to less-privileged users, so the PR:L barrier is realistically low in most deployments. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation yet; the risk is driven by exploitability characteristics and product prevalence, not confirmed in-the-wild use. Signals are consistent rather than conflicting: the CVSS network/low-complexity profile matches the description's 'specially crafted HTTP strings.' The main caveat is the CPE, which lists 'freepbx:security-reporting' (the GitHub advisory repository slug) rather than the actual affected FreePBX framework/UCP module - affected-product metadata should be verified against the vendor advisory. Absence of EPSS/KEV/POC lowers immediacy but does not reduce the intrinsic exploitability; patching to 16.0.39/17.0.7 should be prioritized on internet-facing PBXes.

An attacker who holds (or phishes/brute-forces) any low-privilege UCP user account sends specially crafted HTTP requests with malicious strings in vulnerable URL parameters, chaining shell commands that FreePBX fails to sanitize. The commands execute on the host as the webserver/asterisk user, giving the attacker code execution on the PBX. No public exploit code is identified in the provided data, but the low complexity and commonality of UCP accounts make this practical.