FreePBX Superfecta CVE-2026-54710

Requires an authenticated session with a KNOWN valid username on the FreePBX web interface (PR:L) and the Superfecta module being installed/enabled. Full RCE is not achievable from the inclusion flaw alone: per the advisory it must be chained with (1) arbitrary directory creation via the backup module and (2) a file upload that reveals full filesystem paths via the soundlang module, so the attacker can place and reference a PHP payload the sources/ inclusion logic will load. Limiting factors: valid credentials are mandatory, the Superfecta/backup/soundlang modules must be present, and successful exploitation depends on the multi-module chaining rather than a single request. Affects FreePBX prior to 16.0.40 and 17.0.7.

This is a genuine, high-priority vulnerability but not a drop-everything emergency for internet-facing panic. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) rates it 8.6, reflecting network-reachable, low-complexity RCE that yields full confidentiality and integrity impact on the vulnerable system. The critical mitigating signal is PR:L: exploitation requires authentication with a KNOWN username, so it is not a pure unauthenticated pre-auth RCE. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active exploitation or mass automation at time of analysis - this argues for prompt-but-scheduled patching rather than crisis response. Note a taxonomy mismatch: the assigned CWE-20 (improper input validation) understates the true nature, which is unsafe dynamic PHP file inclusion (LFI-to-RCE, closer to CWE-98) - this is a description/CWE inconsistency worth flagging, not a blocker. Also note the attack is not fully self-contained: full RCE is described as requiring chaining with arbitrary directory creation (backup module) and path-revealing file uploads (soundlang module), which raises real-world exploitation complexity above what AC:L alone suggests.

An attacker who has obtained any valid FreePBX web account (even a low-privilege known username) sends a crafted AJAX request to the Superfecta module's options/save_options handler, supplying input that controls which PHP file is included from the sources/ directory. By first planting a PHP payload at a known path - using the backup module to create an arbitrary directory and the soundlang module upload to reveal the full filesystem path - the attacker forces inclusion of their file and executes arbitrary PHP as the web server user. No public exploit code is identified at time of analysis, but the advisory describes the full chain in detail.