FreePBX CVE-2026-54708

Exploitation requires an authenticated FreePBX account whose user holds sufficient access permissions and/or write access to backup files, plus the ability to reach the FreePBX web administration interface over the network (AV:N/PR:L/UI:N). The specific vulnerable feature is the backup Module's restore functionality, where improper path sanitization lets a crafted backup archive place a PHP file into the web root. Limiting factors: the required low-privilege authentication (not pre-auth), the need for backup/restore permissions on that account, and network reachability of the admin UI - instances with the web GUI restricted to internal/VPN networks and tight operator permissions are substantially harder to exploit. Affected only prior to 16.0.72 and 17.0.7.

This is a genuinely high-priority issue for exposed FreePBX instances, though not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a low-complexity, remotely reachable flaw needing only low-privilege authentication and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) reflecting arbitrary code execution via an uploaded PHP webshell. The key mitigating signal is PR:L: the attacker must already hold a valid FreePBX account with sufficient permissions and/or write access to backup files, so this is not a pre-auth internet worm. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, indicating no confirmed active exploitation to date - so this reads as a high-severity-but-conditionally-gated issue rather than a mass-exploited one. The high CVSS is driven by RCE impact, not by exposure ease; the auth requirement is what keeps real-world risk below the raw 8.6 number. Note the vendor set VA:N (no availability impact) despite this being arbitrary code execution, which is conservative - full server compromise typically implies availability impact as well; verify against the vendor advisory.

An attacker who has obtained (via phishing, weak credentials, or a low-privilege operator account) a FreePBX login with backup permissions crafts a malicious backup archive whose restore path traverses out of the intended directory. Restoring it writes a PHP file into the web root, which the attacker then requests over HTTP to execute arbitrary code as the web server user. No public exploit code is identified in the provided data, but the path-traversal-to-webshell pattern is well understood and straightforward to reproduce.