In older releases of the FreePBX IP PBX backup module, the code that restores a backup does not validate or restrict the data from a tar archive before calling unserialize() on it. This uncontrolled deserialization of untrusted data allows an attacker to attack the system by embedding malicious payloads in a backup file and triggering the restore process. The vulnerability is identified as a Deserialization of Untrusted Data weakness and can result in arbitrary code execution running as the web server user, typically asterisk or www-data. Authentication with an account that has the ability to execute restore operations is required, but no additional shell or file write privileges beyond the normal restore workflow are needed. The issue is fixed in FreePBX versions 16.0.71 and 17.0.6.

This flaw affects the FreePBX backup module in all versions prior to 16.0.71 and 17.0.6. The affected product is the FreePBX IP PBX, a vulnerability expose across the free and open source PBX suite. Organizations running these older releases are vulnerable when they restore backups from potentially untrusted tar archives.

The CVSS score for this vulnerability is 8.6, indicating high severity. Because the EPSS score is not available, the exact likelihood of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote: an attacker who gains the ability to submit a backup archive to the restore endpoint can trigger execution of malicious code on the server without needing shell, CLI, or additional filesystem write permissions. Authentication with a user that has restore rights is needed; if such privileges are restricted, the impact scope is reduced. Given the high severity and the fact that the flaw exists in widely deployed open-source software, it should be treated as an urgent risk.