FreePBX CVE-2026-54675

Requires authenticated access to the FreePBX web interface with a KNOWN, valid username (PR:L) and the ability to reach the sound-language upload and conversion functionality. Exploitation abuses insufficient path sanitization in the file conversion process to perform path-traversal writes of malicious PHP into the web server's document root, so the PHP handler and a writable/servable web root are implicitly required. Limiting factors: valid credentials are mandatory (not unauthenticated), and network reachability of the FreePBX admin/web interface is needed; no user interaction beyond the attacker's own authenticated session is required (UI:N). Real-world exposure is amplified where FreePBX panels are internet-facing or protected by weak/default operator credentials, and reduced where the panel is network-segmented.

This is a genuine priority within FreePBX deployments, though not a mass-exploitation emergency based on current signals. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H = 8.7) describes a network-reachable, low-complexity path-traversal file write that chains directly to remote code execution with full confidentiality, integrity, and availability impact - a very high technical-impact outcome. The critical mitigating factor is PR:L: exploitation requires authenticated access with a KNOWN username, so this is not an unauthenticated internet-wide bug. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable weaponization yet; the only source is the vendor GHSA advisory. Net: high technical severity and a clean RCE path, but real-world urgency is bounded by the authentication requirement and the absence of exploitation telemetry. Because FreePBX admin panels are frequently exposed to the internet and often protected by weak or default operator credentials, the PR:L barrier is realistically low in many deployments - treat as high priority for internet-exposed instances, medium for segmented/internal ones.

An attacker who has obtained valid FreePBX web credentials for a known username (e.g., via credential reuse, weak admin passwords, or a lower-privileged operator account) navigates to the sound-language upload and conversion feature and submits a file whose conversion path escapes the intended directory via path traversal, writing a malicious PHP file into the web server's document root. The attacker then requests that PHP file over HTTP to execute arbitrary code on the PBX host. No public exploit code is identified at time of analysis, but the vendor advisory documents the mechanism clearly enough to reproduce.