Vulnerability · Published Sep 28, 2026 · Assigned by GitHub_M
CVE-2026-54708Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
High 8.6
In plain English
A high-severity path traversal in security-reporting from FreePBX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FreePBX | security-reporting | < 16.0.72< 17.0.7 |
Weakness: CWE-22, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N