Description
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Published: 2026-09-28
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

FreePBX’s backup restore functionality contains a path traversal flaw that lets an authenticated user with sufficient permissions write files to arbitrary locations, specifically the web root. By uploading a malicious PHP file through this mechanism, the attacker can run arbitrary code on the server, compromising confidentiality, integrity, and availability. This weakness combines improper path sanitization (CWE‑22) and code injection (CWE‑94).

Affected Systems

FreePBX versions prior to 16.0.72 and 17.0.7 are affected. The flaw exists in the backup module of the open source IP PBX and is not present in the patches released in those milestone versions.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity for Remote Code Execution. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication but only a user with write permissions to backup files; once authenticated, the attacker can traverse paths and upload code, making the risk significant for any environment where the backup module is enabled.

Generated by OpenCVE AI on September 28, 2026 at 18:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch by upgrading to FreePBX 16.0.72 or 17.0.7.
  • If an upgrade cannot be performed immediately, revoke write permissions for backup files or disable the backup module until a fix is available.
  • Monitor logs for unexpected PHP uploads or changes to the web root and enforce strict file‑system permissions to prevent unauthorized persistence.

Generated by OpenCVE AI on September 28, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Sangoma
Sangoma freepbx
CPEs cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*
Vendors & Products Sangoma
Sangoma freepbx
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 29 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Freepbx
Freepbx security-reporting
Vendors & Products Freepbx
Freepbx security-reporting

Mon, 28 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Title Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
Weaknesses CWE-22
CWE-94
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Freepbx Security-reporting
Sangoma Freepbx
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T15:33:44.408Z

Reserved: 2026-06-15T22:58:06.563Z

Link: CVE-2026-54708

cve-icon Vulnrichment

Updated: 2026-09-29T15:33:38.379Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-28T18:17:22.883

Modified: 2026-10-16T18:20:12.777

Link: CVE-2026-54708

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:15:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')