CVE-2026-54708
FreePBX is an open source IP PBX
- Risk score
- 62/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup fil…
- Affected
- Sangoma Freepbx before 16.0.72, 17.0.7
- Fix
- Upgrade Sangoma Freepbx to 16.0.72 or 17.0.7 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Last activity 28 Sep 2026. Patch Forecast updates every hour.