Freepbx
Monthly
Authenticated command injection in FreePBX prior to 17.0.9 allows a user who is authorized to access the GraphQL API module interface to execute arbitrary shell commands on the PBX host, running as the web/PBX service account (typically 'asterisk'). The flaw sits in the PBX API module's documentation generator, which accepts a caller-supplied 'host' parameter and interpolates it into a shell command; the code validates the generated OAuth access token before execution but never validates or escapes the host value. Exploitation requires a pre-existing, privileged account with API-module authorization (CVSS:4.0 PR:H, our assessment CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), which materially limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 17.0.9.
Authenticated remote code execution in the FreePBX Superfecta module (FreePBX prior to 16.0.40 and 17.0.7) allows a user holding valid credentials with a known username to make the module's AJAX handler dynamically include attacker-influenced PHP files from its sources/ directory, executing arbitrary PHP with the privileges of the web server user. Exploitation is remote and low-complexity from the attacker's side (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, score 8.6), but our assessment notes the inclusion flaw alone is not sufficient: per the GitHub advisory (GHSA-j53p-5m8r-j3p6) the attacker must chain it with arbitrary directory creation via the backup module and a path-revealing file upload via the soundlang module, so the Superfecta, backup, and soundlang modules must all be present and a valid login is mandatory (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released patches are available in versions 16.0.40 and 17.0.7, making this a high-priority fix rather than an internet-facing emergency, particularly for systems with the affected modules exposed to untrusted users.
Authenticated users holding backup or restore privileges on affected FreePBX deployments can achieve remote code execution through the backup Module on versions prior to 16.0.72 and 17.0.7. Improper path sanitization during backup restore lets a crafted archive place attacker-controlled PHP files directly into the web root, where the FreePBX web server will execute them, giving the attacker full control of the host and, by extension, the underlying Asterisk telephony platform (CVSS:4.0 8.6; independent assessment scores CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact). Exploitation is not pre-authentication: it requires a valid account with sufficient access permissions and/or write access to backup files plus network reachability of the FreePBX administration interface, and no public exploit code has been identified at time of analysis. This is a high-priority issue for internet-exposed or broadly permissioned FreePBX instances rather than a drop-everything emergency, since the primary attack surface is a privileged administrative workflow.
Authenticated remote code execution in FreePBX (versions prior to 16.0.10 and 17.0.5) lets an attacker who possesses a valid, known username abuse the sound-language upload and conversion workflow to write arbitrary files, including malicious PHP, into the web server's document root. The root cause is a path-traversal weakness (CWE-22) in the conversion step where path sanitization is insufficient, and successful exploitation gives full confidentiality, integrity and availability impact on the PBX host (vendor CVSS v4.0 8.7; independent assessment CVSS v3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so authentication - not user interaction - is the gate). No CISA KEV entry and no public exploit code were identified at time of analysis, meaning this is a high-severity, patch-now issue for PBX administrators rather than a mass-exploitation emergency; practical risk concentrates where FreePBX administrative panels are internet-facing or protected by weak or default operator credentials, and is reduced where the panel is network-segmented.
Authenticated command injection in the FreePBX User Control Panel (UCP) allows any account with UCP access - including low-privilege users who are frequently granted UCP but not Administrator Control Panel (ACP) rights - to run arbitrary commands on the PBX host as the web-server user (typically asterisk) via crafted HTTP requests. The flaw affects FreePBX versions prior to 16.0.39 and 17.0.7 and stems from insufficient sanitization of UCP URL parameters, which permits command chaining into host binaries; the vendor rates it CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) and the independent assessment concurs with high confidentiality and integrity impact over the network with low privileges required. No public exploit identified at time of analysis, and successful exploitation requires a valid UCP session plus network reachability to the PBX web interface, but no victim interaction.
Command injection in the FreePBX Music on Hold (MoH) module lets anyone holding an existing FreePBX administrator account run arbitrary system commands with the privileges of the Asterisk service, because a POST parameter that defines a custom Asterisk application is stored in the database unsanitized and later written verbatim into musiconhold_additional.conf, which Asterisk loads and executes. Deployments running FreePBX prior to 16.0.4 or 17.0.6 with the MoH module enabled and a functioning Asterisk backend are exposed; the vendor has patched the issue in 16.0.4 and 17.0.6. The required admin credentials (PR:L in the published CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) make this a post-authentication privilege-to-code-execution flaw rather than a pre-auth remote takeover, so realistic risk is confined to insider misuse, credential theft, or chaining from another auth bypass; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available intelligence.
Command injection in FreePBX UCP Node server before 17.0.9 allows unauthenticated remote attackers to run arbitrary OS commands as the asterisk service user. The Socket.IO 4 middleware (io.use(checkAuth)) only guards the default namespace, so a client can reach unprotected custom namespaces and inject carriage-return/newline characters into Asterisk Manager Interface actions to execute commands. This is an authentication-bypass-plus-CRLF-injection chain; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.
Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Authentication bypass in FreePBX api module (versions prior to 17.0.8) allows OAuth2 access tokens to be issued without verifying the client_secret, because the ClientRepository validateClient() method unconditionally returns true. An attacker who knows or guesses a valid client_id can mint tokens granting API access to the PBX, leading to unauthorized read and write operations against telephony configuration. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
SQL injection in FreePBX CDR Reports module prior to versions 16.0.50 and 17.0.11 allows authenticated users with CDR section access to execute arbitrary SQL queries via the order and sort POST parameters. The flaw requires a valid Administration Control Panel account but not full administrator privileges, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV. The CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact against the call detail records database.
Local file inclusion in FreePBX versions prior to 16.0.22 and 17.0.5 allows authenticated remote attackers to include arbitrary .class.php files from the filesystem via path traversal in the Dashboard module's getcontent AJAX handler. The unsanitized $_REQUEST['rawname'] parameter is concatenated into a PHP include() call, and any included file's top-level code executes before the subsequent class instantiation fails. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but CWE-98 PHP file inclusion bugs are historically high-value targets in PBX systems exposed to the internet.
Authentication bypass in FreePBX User Control Panel (UCP) versions 15.0.42 through 16.0.44 and 17.0.0 through 17.0.6 allows remote unauthenticated attackers to access UCP accounts using hard-coded initial template credentials when administrators fail to rotate them after enabling the feature. With a CVSS 4.0 score of 9.3 and CWE-798 (Use of Hard-coded Credentials), the flaw exposes high-confidentiality and high-integrity impact to the affected component, though no public exploit identified at time of analysis.
Command injection in FreePBX API module 17.0.8 and earlier allows authenticated attackers with valid bearer tokens to execute arbitrary operating system commands as the web server user via malicious GraphQL mutations. The initiateGqlAPIProcess() function passes unsanitized GraphQL moduleOperations mutation input directly to shell_exec(), enabling backtick-wrapped command execution. While requiring high privileges (PR:H), the vulnerability provides complete system compromise within the web server context (CVSS 8.6). Vendor patch available via GitHub commit 5f194e39. No public exploit code or active exploitation confirmed at time of analysis.
Unauthenticated command injection in FreePBX recordings module (versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4) allows authenticated attackers to execute arbitrary system commands with full system privileges. The vulnerability stems from improper input validation in the recordings functionality, enabling complete compromise of affected FreePBX installations. No patch is currently available.
SQL injection in the FreePBX logfiles module allows authenticated attackers to manipulate database queries and potentially extract sensitive data or modify system records. Versions prior to 16.0.10 and 17.0.5 are vulnerable, and attackers with valid FreePBX credentials can exploit this weakness to achieve high-impact unauthorized access to confidential information and system integrity. No patch is currently available for affected deployments.
Unauthenticated SQL injection in the FreePBX CDR module (versions before 16.0.49 and 17.0.7) allows authenticated users to execute arbitrary SQL commands and potentially compromise the entire database. An attacker with valid credentials can exploit this vulnerability to read sensitive call records, modify system data, or escalate privileges within the FreePBX system. No patch is currently available, leaving affected installations at high risk until upgrades are deployed.
Unauthenticated command injection in FreePBX versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 via the ElevenLabs Text-to-Speech integration allows authenticated users with high privileges to execute arbitrary system commands. The vulnerability exists in the recordings module and affects all installations using the vulnerable TTS engine. No patch is currently available, leaving affected systems at risk of full system compromise.
Authentication bypass in the FreePBX Endpoint Manager module lets remote, unauthenticated attackers impersonate any targeted user - including administrators - by sending an Authorization header containing an arbitrary value, but only on installations where the module's authentication type is configured to "webserver." The flaw is a classic improper-authentication (CWE-287) defect: the code treats the mere presence of the header as proof of identity instead of validating credentials, so the resulting session is bound to the attacker-chosen account. Instances using the default database authentication mode are not affected; there is no user interaction or attacker credential requirement (CVSS 4.0 base 9.3, assessed 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis).
Authenticated arbitrary file upload in the FreePBX Endpoint Manager module (FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6) lets a logged-in admin-interface user abuse the fwbrand parameter to override the upload destination path, writing attacker-controlled files such as a PHP webshell into web-accessible locations and thereby achieving remote code execution. Exploitation requires an authenticated session with access to the Endpoint Manager module and a known/valid username, so real-world risk is concentrated on deployments with internet-exposed admin GUIs, weak or reused credentials, or over-broad module permissions. Publicly available exploit code exists and EPSS is elevated at 43.68% (99th percentile), but the flaw is not confirmed actively exploited (no CISA KEV listing); vendor patches are available in 16.0.92 and 17.0.6.
Authenticated SQL injection in the FreePBX Endpoint Manager module allows a user holding a valid, known FreePBX username to execute arbitrary SQL against the underlying database through multiple parameters in the basestation, model, firmware, and custom extension configuration functionality. Affected deployments are FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6 with the Endpoint Manager module installed and in use; the attack is network-reachable and requires no user interaction, but exploitation is gated on an authenticated session (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), so unauthenticated remote attackers cannot trigger it directly. Publicly available exploit code exists and EPSS is elevated at 38.45% (99th percentile), but this is not a drop-everything emergency because the attacker must already possess valid credentials; successful exploitation yields high confidentiality and integrity impact and low availability impact.
FreePBX 15, 16, and 17 contain SQL injection vulnerabilities enabling unauthenticated access to the administrator interface, leading to database manipulation and remote code execution.
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.5%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
Freepbx versions up to 17.0.5 contains a vulnerability that allows attackers to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX tha (CVSS 7.5).
SQL injection in the FreePBX Text-to-Speech (tts) module lets authenticated administrators extract sensitive data from the backend database and, through a chained post-exploitation path, execute code as the asterisk user with potential elevation to root. FreePBX installations running the tts module at versions prior to 16.0.5 or 17.0.5 are affected; exploitation requires a valid administrator session on the Administrator Control Panel (ACP), so the risk is access-gated rather than a mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in 16.0.5 and 17.0.5.
Local privilege escalation in FreePBX framework versions prior to 16.0.45 and 17.0.24 allows a local user in the asterisk group to place a malicious freepbx_engine file in /etc/asterisk/, which the deprecated amportal startup script may then execute with root privileges. The flaw is not remotely exploitable; exploitation requires write access to /etc/asterisk/, the legacy amportal utility to still be executed as root, and the attacker to already hold a local account in the asterisk group. EPSS is low at 0.13% (2nd percentile), and no public exploit or confirmed active exploitation is identified in the available data.
SQL injection in the FreePBX Endpoint Manager REST API allows an authenticated administrator to execute arbitrary SQL commands, potentially compromising sensitive data or modifying database contents. The flaw requires high (administrative) privileges and the Endpoint Manager module to be enabled, so exploitation is limited to malicious or compromised admins or post-credential-theft scenarios. With a low EPSS score of 0.04% (12th percentile), no public exploit code, and no CISA KEV listing, the immediate exploitation risk is low, though the 8.6 CVSS 4.0 score reflects the severity if exploited.
Reflected cross-site scripting in FreePBX's Asterisk HTTP Status page can let remote attackers steal an authenticated administrator's session cookies and hijack the FreePBX admin UI, but only if the status page is network-reachable and a logged-in admin actively opens a crafted link. FreePBX 16 before 16.0.68.39 is exposed by default on any bound IP at port 8088, while FreePBX 17 before 17.0.18.38 binds the page to localhost by default, so default v17 installs are not remotely exploitable unless that binding is changed. This is a genuine but conditional priority rather than a drop-everything emergency; no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile).
OS command injection in the FreePBX Endpoint Manager module's Network Scanning feature allows a highly privileged, authenticated user to execute arbitrary operating system commands as the asterisk service account, affecting Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6. The CVSS 4.0 base score is 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L), and our independent assessment concurs with high confidentiality and integrity impact but only low availability impact, since this is effectively post-authentication command execution rather than a pre-auth compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.53% (43rd percentile), so the practical risk is concentrated in deployments where the Endpoint Manager commercial module is installed and its Network Scanning feature is reachable. Vendor-released patches exist: Endpoint Manager 16.0.92 and 17.0.6.
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was discovered in FreePBX 17.0.19.17. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 52.0%.
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.3%.
Authenticated command injection in FreePBX prior to 17.0.9 allows a user who is authorized to access the GraphQL API module interface to execute arbitrary shell commands on the PBX host, running as the web/PBX service account (typically 'asterisk'). The flaw sits in the PBX API module's documentation generator, which accepts a caller-supplied 'host' parameter and interpolates it into a shell command; the code validates the generated OAuth access token before execution but never validates or escapes the host value. Exploitation requires a pre-existing, privileged account with API-module authorization (CVSS:4.0 PR:H, our assessment CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), which materially limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 17.0.9.
Authenticated remote code execution in the FreePBX Superfecta module (FreePBX prior to 16.0.40 and 17.0.7) allows a user holding valid credentials with a known username to make the module's AJAX handler dynamically include attacker-influenced PHP files from its sources/ directory, executing arbitrary PHP with the privileges of the web server user. Exploitation is remote and low-complexity from the attacker's side (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, score 8.6), but our assessment notes the inclusion flaw alone is not sufficient: per the GitHub advisory (GHSA-j53p-5m8r-j3p6) the attacker must chain it with arbitrary directory creation via the backup module and a path-revealing file upload via the soundlang module, so the Superfecta, backup, and soundlang modules must all be present and a valid login is mandatory (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor-released patches are available in versions 16.0.40 and 17.0.7, making this a high-priority fix rather than an internet-facing emergency, particularly for systems with the affected modules exposed to untrusted users.
Authenticated users holding backup or restore privileges on affected FreePBX deployments can achieve remote code execution through the backup Module on versions prior to 16.0.72 and 17.0.7. Improper path sanitization during backup restore lets a crafted archive place attacker-controlled PHP files directly into the web root, where the FreePBX web server will execute them, giving the attacker full control of the host and, by extension, the underlying Asterisk telephony platform (CVSS:4.0 8.6; independent assessment scores CVSS:3.1 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact). Exploitation is not pre-authentication: it requires a valid account with sufficient access permissions and/or write access to backup files plus network reachability of the FreePBX administration interface, and no public exploit code has been identified at time of analysis. This is a high-priority issue for internet-exposed or broadly permissioned FreePBX instances rather than a drop-everything emergency, since the primary attack surface is a privileged administrative workflow.
Authenticated remote code execution in FreePBX (versions prior to 16.0.10 and 17.0.5) lets an attacker who possesses a valid, known username abuse the sound-language upload and conversion workflow to write arbitrary files, including malicious PHP, into the web server's document root. The root cause is a path-traversal weakness (CWE-22) in the conversion step where path sanitization is insufficient, and successful exploitation gives full confidentiality, integrity and availability impact on the PBX host (vendor CVSS v4.0 8.7; independent assessment CVSS v3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so authentication - not user interaction - is the gate). No CISA KEV entry and no public exploit code were identified at time of analysis, meaning this is a high-severity, patch-now issue for PBX administrators rather than a mass-exploitation emergency; practical risk concentrates where FreePBX administrative panels are internet-facing or protected by weak or default operator credentials, and is reduced where the panel is network-segmented.
Authenticated command injection in the FreePBX User Control Panel (UCP) allows any account with UCP access - including low-privilege users who are frequently granted UCP but not Administrator Control Panel (ACP) rights - to run arbitrary commands on the PBX host as the web-server user (typically asterisk) via crafted HTTP requests. The flaw affects FreePBX versions prior to 16.0.39 and 17.0.7 and stems from insufficient sanitization of UCP URL parameters, which permits command chaining into host binaries; the vendor rates it CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) and the independent assessment concurs with high confidentiality and integrity impact over the network with low privileges required. No public exploit identified at time of analysis, and successful exploitation requires a valid UCP session plus network reachability to the PBX web interface, but no victim interaction.
Command injection in the FreePBX Music on Hold (MoH) module lets anyone holding an existing FreePBX administrator account run arbitrary system commands with the privileges of the Asterisk service, because a POST parameter that defines a custom Asterisk application is stored in the database unsanitized and later written verbatim into musiconhold_additional.conf, which Asterisk loads and executes. Deployments running FreePBX prior to 16.0.4 or 17.0.6 with the MoH module enabled and a functioning Asterisk backend are exposed; the vendor has patched the issue in 16.0.4 and 17.0.6. The required admin credentials (PR:L in the published CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) make this a post-authentication privilege-to-code-execution flaw rather than a pre-auth remote takeover, so realistic risk is confined to insider misuse, credential theft, or chaining from another auth bypass; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available intelligence.
Command injection in FreePBX UCP Node server before 17.0.9 allows unauthenticated remote attackers to run arbitrary OS commands as the asterisk service user. The Socket.IO 4 middleware (io.use(checkAuth)) only guards the default namespace, so a client can reach unprotected custom namespaces and inject carriage-return/newline characters into Asterisk Manager Interface actions to execute commands. This is an authentication-bypass-plus-CRLF-injection chain; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.
Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Authentication bypass in FreePBX api module (versions prior to 17.0.8) allows OAuth2 access tokens to be issued without verifying the client_secret, because the ClientRepository validateClient() method unconditionally returns true. An attacker who knows or guesses a valid client_id can mint tokens granting API access to the PBX, leading to unauthorized read and write operations against telephony configuration. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
SQL injection in FreePBX CDR Reports module prior to versions 16.0.50 and 17.0.11 allows authenticated users with CDR section access to execute arbitrary SQL queries via the order and sort POST parameters. The flaw requires a valid Administration Control Panel account but not full administrator privileges, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV. The CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact against the call detail records database.
Local file inclusion in FreePBX versions prior to 16.0.22 and 17.0.5 allows authenticated remote attackers to include arbitrary .class.php files from the filesystem via path traversal in the Dashboard module's getcontent AJAX handler. The unsanitized $_REQUEST['rawname'] parameter is concatenated into a PHP include() call, and any included file's top-level code executes before the subsequent class instantiation fails. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but CWE-98 PHP file inclusion bugs are historically high-value targets in PBX systems exposed to the internet.
Authentication bypass in FreePBX User Control Panel (UCP) versions 15.0.42 through 16.0.44 and 17.0.0 through 17.0.6 allows remote unauthenticated attackers to access UCP accounts using hard-coded initial template credentials when administrators fail to rotate them after enabling the feature. With a CVSS 4.0 score of 9.3 and CWE-798 (Use of Hard-coded Credentials), the flaw exposes high-confidentiality and high-integrity impact to the affected component, though no public exploit identified at time of analysis.
Command injection in FreePBX API module 17.0.8 and earlier allows authenticated attackers with valid bearer tokens to execute arbitrary operating system commands as the web server user via malicious GraphQL mutations. The initiateGqlAPIProcess() function passes unsanitized GraphQL moduleOperations mutation input directly to shell_exec(), enabling backtick-wrapped command execution. While requiring high privileges (PR:H), the vulnerability provides complete system compromise within the web server context (CVSS 8.6). Vendor patch available via GitHub commit 5f194e39. No public exploit code or active exploitation confirmed at time of analysis.
Unauthenticated command injection in FreePBX recordings module (versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4) allows authenticated attackers to execute arbitrary system commands with full system privileges. The vulnerability stems from improper input validation in the recordings functionality, enabling complete compromise of affected FreePBX installations. No patch is currently available.
SQL injection in the FreePBX logfiles module allows authenticated attackers to manipulate database queries and potentially extract sensitive data or modify system records. Versions prior to 16.0.10 and 17.0.5 are vulnerable, and attackers with valid FreePBX credentials can exploit this weakness to achieve high-impact unauthorized access to confidential information and system integrity. No patch is currently available for affected deployments.
Unauthenticated SQL injection in the FreePBX CDR module (versions before 16.0.49 and 17.0.7) allows authenticated users to execute arbitrary SQL commands and potentially compromise the entire database. An attacker with valid credentials can exploit this vulnerability to read sensitive call records, modify system data, or escalate privileges within the FreePBX system. No patch is currently available, leaving affected installations at high risk until upgrades are deployed.
Unauthenticated command injection in FreePBX versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 via the ElevenLabs Text-to-Speech integration allows authenticated users with high privileges to execute arbitrary system commands. The vulnerability exists in the recordings module and affects all installations using the vulnerable TTS engine. No patch is currently available, leaving affected systems at risk of full system compromise.
Authentication bypass in the FreePBX Endpoint Manager module lets remote, unauthenticated attackers impersonate any targeted user - including administrators - by sending an Authorization header containing an arbitrary value, but only on installations where the module's authentication type is configured to "webserver." The flaw is a classic improper-authentication (CWE-287) defect: the code treats the mere presence of the header as proof of identity instead of validating credentials, so the resulting session is bound to the attacker-chosen account. Instances using the default database authentication mode are not affected; there is no user interaction or attacker credential requirement (CVSS 4.0 base 9.3, assessed 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis).
Authenticated arbitrary file upload in the FreePBX Endpoint Manager module (FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6) lets a logged-in admin-interface user abuse the fwbrand parameter to override the upload destination path, writing attacker-controlled files such as a PHP webshell into web-accessible locations and thereby achieving remote code execution. Exploitation requires an authenticated session with access to the Endpoint Manager module and a known/valid username, so real-world risk is concentrated on deployments with internet-exposed admin GUIs, weak or reused credentials, or over-broad module permissions. Publicly available exploit code exists and EPSS is elevated at 43.68% (99th percentile), but the flaw is not confirmed actively exploited (no CISA KEV listing); vendor patches are available in 16.0.92 and 17.0.6.
Authenticated SQL injection in the FreePBX Endpoint Manager module allows a user holding a valid, known FreePBX username to execute arbitrary SQL against the underlying database through multiple parameters in the basestation, model, firmware, and custom extension configuration functionality. Affected deployments are FreePBX 16 before 16.0.92 and FreePBX 17 before 17.0.6 with the Endpoint Manager module installed and in use; the attack is network-reachable and requires no user interaction, but exploitation is gated on an authenticated session (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), so unauthenticated remote attackers cannot trigger it directly. Publicly available exploit code exists and EPSS is elevated at 38.45% (99th percentile), but this is not a drop-everything emergency because the attacker must already possess valid credentials; successful exploitation yields high confidentiality and integrity impact and low availability impact.
FreePBX 15, 16, and 17 contain SQL injection vulnerabilities enabling unauthenticated access to the administrator interface, leading to database manipulation and remote code execution.
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.5%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
Freepbx versions up to 17.0.5 contains a vulnerability that allows attackers to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX tha (CVSS 7.5).
SQL injection in the FreePBX Text-to-Speech (tts) module lets authenticated administrators extract sensitive data from the backend database and, through a chained post-exploitation path, execute code as the asterisk user with potential elevation to root. FreePBX installations running the tts module at versions prior to 16.0.5 or 17.0.5 are affected; exploitation requires a valid administrator session on the Administrator Control Panel (ACP), so the risk is access-gated rather than a mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in 16.0.5 and 17.0.5.
Local privilege escalation in FreePBX framework versions prior to 16.0.45 and 17.0.24 allows a local user in the asterisk group to place a malicious freepbx_engine file in /etc/asterisk/, which the deprecated amportal startup script may then execute with root privileges. The flaw is not remotely exploitable; exploitation requires write access to /etc/asterisk/, the legacy amportal utility to still be executed as root, and the attacker to already hold a local account in the asterisk group. EPSS is low at 0.13% (2nd percentile), and no public exploit or confirmed active exploitation is identified in the available data.
SQL injection in the FreePBX Endpoint Manager REST API allows an authenticated administrator to execute arbitrary SQL commands, potentially compromising sensitive data or modifying database contents. The flaw requires high (administrative) privileges and the Endpoint Manager module to be enabled, so exploitation is limited to malicious or compromised admins or post-credential-theft scenarios. With a low EPSS score of 0.04% (12th percentile), no public exploit code, and no CISA KEV listing, the immediate exploitation risk is low, though the 8.6 CVSS 4.0 score reflects the severity if exploited.
Reflected cross-site scripting in FreePBX's Asterisk HTTP Status page can let remote attackers steal an authenticated administrator's session cookies and hijack the FreePBX admin UI, but only if the status page is network-reachable and a logged-in admin actively opens a crafted link. FreePBX 16 before 16.0.68.39 is exposed by default on any bound IP at port 8088, while FreePBX 17 before 17.0.18.38 binds the page to localhost by default, so default v17 installs are not remotely exploitable unless that binding is changed. This is a genuine but conditional priority rather than a drop-everything emergency; no public exploit identified at time of analysis, and EPSS is low at 0.19% (8th percentile).
OS command injection in the FreePBX Endpoint Manager module's Network Scanning feature allows a highly privileged, authenticated user to execute arbitrary operating system commands as the asterisk service account, affecting Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6. The CVSS 4.0 base score is 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L), and our independent assessment concurs with high confidentiality and integrity impact but only low availability impact, since this is effectively post-authentication command execution rather than a pre-auth compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.53% (43rd percentile), so the practical risk is concentrated in deployments where the Endpoint Manager commercial module is installed and its Network Scanning feature is reachable. Vendor-released patches exist: Endpoint Manager 16.0.92 and 17.0.6.
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
FreePBX is an open-source web-based graphical user interface. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was discovered in FreePBX 17.0.19.17. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 52.0%.
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.3%.