FreePBX, the open source IP PBX, has a flaw in its sound language upload and conversion feature that allows an authenticated user to write arbitrary files to the filesystem. The vulnerability arises from insufficient sanitization of file paths during conversion, enabling path traversal attacks that place malicious PHP files in the web server’s root directory. Once these files are placed, an attacker can execute arbitrary server‑side code, effectively gaining full control over the web host.

The vulnerability affects installations of FreePBX prior to version 16.0.10 and 17.0.5. Any older releases and permitting authenticated file uploads is susceptible to exploitation.

The CVSS score of 8.7 highlights the high severity of this issue, although the EPSS is not available and it is not listed in CISA’s KEV catalog. An attacker must first authenticate with a valid user account to use the upload feature; once authenticated, the path traversal flaw allows the attacker to write malicious files into the web root and execute them. The exploitation chain is straightforward: authenticated upload → path traversal → arbitrary PHP file stored in the web root → remote code execution. The lack of an available EPSS score suggests that exploitation probability has not been quantified, but the high CVSS implies significant potential impact for those that can attain authentication.