CVE-2026-44239
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In FreePBX prior to versions 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs.
Risk Assessment
An attacker can remotely execute arbitrary PHP code, leading to full compromise of the FreePBX server, including access to sensitive data, call eavesdropping, and disruption of telephony services.
Recommendation
Immediately upgrade FreePBX to version 16.0.22 or 17.0.5. If upgrading is not possible, restrict access to the administrative interface to trusted networks only.
Other vulnerabilities in FreePBX
See all- CVE-2026-73665Critical
FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.
- CVE-2026-73663Critical
FreePBX from 16.0.0 until 16.0.11 and 17.0.4 has a vulnerability in the missedcall module, where the Caller ID name from crafted SIP From headers is inserted into an SQL query without escaping. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, allowing modification of administrator accounts and unauthorized remote access.
- CVE-2026-46376Critical
A vulnerability in FreePBX from version 15.0.42 to before 16.0.45 and 17.0.7 allows unauthenticated users to access the User Control Panel (UCP) using hard-coded initial template credentials if the administrator did not change them immediately after enabling UCP. This issue is fixed in versions 16.0.45 and 17.0.7.
- CVE-2026-73664High
FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.
- CVE-2026-73662High
FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.
- CVE-2026-73661High
FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.
- CVE-2026-73660High
FreePBX before versions 16.0.6 and 17.0.5.4 has a vulnerability in the Text-To-Speech module that allows an administrator to save a TTS destination name that is HTML-encoded, decoded during dialplan generation, passed as an AGI argument, and used to build filenames in agi-bin/propolys-tts.agi. The destination name reaches a raw shell-command execution path, allowing arbitrary OS command execution as the asterisk user.
- CVE-2026-44238High
The CDR Reports module in FreePBX before versions 16.0.50 and 17.0.11 contains an SQL injection vulnerability via the 'order' and 'sort' POST parameters. Authentication with a CDR section access account is required, but full admin privileges are not needed.
- CVE-2026-44237High
In FreePBX prior to 17.0.8, the OAuth2 implementation in the API module does not properly validate client credentials during token issuance. The validateClient() method in ClientRepository.php always returns true, allowing anyone with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret.
- CVE-2026-26978High
In FreePBX before versions 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, allowing Remote Code Execution (RCE) by restoring a crafted backup containing malicious data. Authentication with sufficient privileges is required. Fixed in versions 16.0.71 and 17.0.6.
Original NVD description (English source)
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.