The vulnerability allows a logged‑in user of the FreePBX Dashboard module to supply a crafted request that results in the server including an arbitrary .class.php file from the filesystem. The included file is executed before the system attempts to instantiate the intended class, which can lead to arbitrary code execution or compromise of system confidentiality and integrity. The weakness is a classic path traversal flaw (CWE‑98).

FreePBX versions preceding 16.0.22 and 17.0.5 are affected. The flaw resides in the Dashboard module’s getcontent AJAX handler and was fixed in the mentioned releases.

This is an authenticated local file inclusion; an attacker must be able to log into the system with a user that has access to the Dashboard module. Because the flaw permits inclusion of any .class.php file, malicious code could be executed on the server. The CVSS score of 7.6 indicates high severity. EPSS information is unavailable, and the flaw is not listed in CISA’s KEV catalog. The primary attack vector is an authenticated user exploiting the AJAX request; detection would require monitoring request patterns for unusual rawname parameters.