CVE-2026-54708GHSA-5hhg-w366-g6fh
security-reporting: Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
FreePBX security-reporting
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.53%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Text from CVE List
Affected versions 4
- security-reportingaffected: < 16.0.72CVE List
- security-reportingaffected: < 17.0.7CVE List
- backup, freepbx 16< 16.0.72GitHub
- backup, freepbx 17< 17.0.7GitHub