An authenticated attacker can execute arbitrary PHP code on the FreePBX web server by exploiting unsafe file inclusion within the Superfecta module. The vulnerability allows the attacker to control the server process using the web server user’s privileges, posing a severe threat to confidentiality, integrity, and availability of the PBX system.

FreePBX installations running Superfecta prior to version 16.0.40 or 17.0.7 are affected. The flaw is present in the module’s AJAX handler, specifically the options and save_options cases, which improperly include PHP files supplied by user input from the sources/ directory.

The CVSS score of 8.6 indicates high severity. EPSS is not available, so the current likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication with a known username and the ability to influence file paths—attacks typically combine the creation of arbitrary directories (via the backup module) and disclosure of full file paths (via the soundlang module).