CVE-2025-67736

FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.

FreePBX from 16.0.0 until 16.0.11 and 17.0.4 has a vulnerability in the missedcall module, where the Caller ID name from crafted SIP From headers is inserted into an SQL query without escaping. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, allowing modification of administrator accounts and unauthorized remote access.

A vulnerability in FreePBX from version 15.0.42 to before 16.0.45 and 17.0.7 allows unauthenticated users to access the User Control Panel (UCP) using hard-coded initial template credentials if the administrator did not change them immediately after enabling UCP. This issue is fixed in versions 16.0.45 and 17.0.7.

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.

FreePBX before versions 16.0.10 and 17.0.5 contains a critical vulnerability in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading to remote code execution (RCE). Authentication with a known username is required. The issue stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory.

FreePBX before versions 16.0.39 and 17.0.7 allows users authenticated via User Control Panel (UCP) to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. The issue is due to insufficient sanitization of certain URL parameters used by UCP, allowing binaries to be executed on the host server by carefully chaining commands.

FreePBX before versions 16.0.4 and 17.0.6 contains a critical flaw in the Music on Hold (MoH) module that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. The root cause is that the module accepts a POST parameter defining a custom Asterisk application, stored without sanitization, and later written directly to the musiconhold_additional.conf configuration file, allowing injection of arbitrary commands.

FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.