| CVE-2026-75600 |
|
High |
Sep 28, 2026 |
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX
more...
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2026-73665 |
|
Critical |
Aug 13, 2026 |
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.
more...
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2026-46376 |
|
Critical |
May 29, 2026 |
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) u
more...
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2026-44239 |
|
High |
May 29, 2026 |
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied
more...
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2026-44238 |
|
High |
May 29, 2026 |
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parame
more...
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2026-44237 |
|
High |
May 29, 2026 |
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials dur
more...
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2025-66039 |
|
Critical |
Dec 09, 2025 |
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the aut
more...
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2025-59429 |
|
Medium |
Oct 14, 2025 |
FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a
more...
FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17.
less...
|
13.0, 15.0.16.42, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2023-43336 |
|
High |
Nov 02, 2023 |
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified paramet
more...
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.
less...
|
13.0, 14.0.10.3, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
| CVE-2019-25090 |
|
Medium |
Dec 27, 2022 |
A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of t
more...
A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.
less...
|
13.0, 2.3.1, 1.10.010, 1.10.006, 1.10.005, 1.10.004, 1.10.003, 1.10.002
|
