FreePBX contains a command injection vulnerability in its recordings module that can be triggered via AJAX endpoints by an authenticated user, allowing arbitrary operating‑system command execution and full compromise of the PBX server; this weakness is identified as CWE‑78.

The flaw affects FreePBX core releases from 16.0.17.2 through before 16.0.20 and from 17.0.2.4 through before 17.0.5, as reported by FreePBX under Sangoma’s security reporting.

The CVSS base score of 8.6 indicates high severity, while the EPSS score of less than 1% implies a low current exploitation probability; the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker be authenticated to the FreePBX web interface and able to send crafted requests to the recordings module AJAX endpoints, making the attack feasible with compromised credentials or local network access.