FreePBX, an open‑source IP PBX, had a vulnerability in its User Control Panel (UCP) that allowed an authenticated user to execute arbitrary commands on the server as the webserver user (typically asterisk). The flaw stems from insufficient sanitization of specific URL parameters, enabling attackers to craft requests that trigger command execution. Because the attacker already holds UCP credentials, which are often granted to lower‑privilege users, the vulnerability can be leveraged by a broad set of accounts to compromise the confidentiality and integrity of the PBX system.

Versions of FreePBX prior to 16.0.39 and 17.0.7 are affected. The vulnerability exists only within the UCP subset of the application and does not impact the higher‑privilege Administrator Control Panel.

The CVSS score of 8.6 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, but because the flaw requires only normal UCP authentication, the attack surface is large. The exploit path is straightforward: send a specially crafted HTTP request to a UCP endpoint; the string is passed to a shell without proper filtering, resulting in command execution as the webserver user.