CVE-2026-54675

FreePBX is an open source IP PBX

Risk score: 63/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.7%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username…
Affected: Sangoma Freepbx before 16.0.10, 17.0.5
Fix: Upgrade Sangoma Freepbx to 16.0.10 or 17.0.5 (whichever matches your release line), or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Sangoma Freepbx: Amber, patch this week. FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often mo…

The flaws

CVE-2026-54675: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
CVE-2026-54674: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
CVE-2026-75600: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
CVE-2026-54708: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Sangoma Freepbx: 16.0.10 · 17.0.5 · 16.0.39 · 17.0.7 · 17.0.9 · 16.0.72 or later on your release line

Who is exposed: Sangoma Freepbx before 16.0.39, 17.0.7

Where it stands

No known exploitation

Connects to

Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
Same product: Earlier Sangoma Freepbx warnings. 2 in the last 90 days

Why it is Amber

CVSS 8.8 high

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-95gm-cmxf-cv8v

Original description

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.

Last activity 28 Sep 2026. Patch Forecast updates every hour.