PT-2026-99959 · Freepbx · Freepbx
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
FreePBX versions prior to 16.0.10
FreePBX versions prior to 17.0.5
Description
An issue in the sound language upload and conversion functionality allows an authenticated attacker with a known username to perform arbitrary file writes. This is caused by insufficient path sanitization during the file conversion process, which enables path traversal attacks to place malicious PHP files in the web server root directory, leading to remote code execution (RCE). Path traversal is a technique used to access files and directories that are stored outside the web root folder.
Recommendations
Update FreePBX to version 16.0.10 or newer.
Update FreePBX to version 17.0.5 or newer.
Fix
RCE
Path traversal
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freepbx