CVE-2026-26978
Remote Code Execution in FreePBX Backup Module
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freepbx | freepbx | to 16.0.71 (inc) |
| freepbx | freepbx | to 17.0.6 (inc) |
| freepbx | freepbx | to 17.0.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FreePBX versions below 16.0.71 and 17.0.6 within the backup module. During the restore operation, FreePBX extracts files from a user-supplied tar archive and passes them directly to the PHP unserialize() function without proper validation, class restrictions, or integrity checks.
If the backup archive contains maliciously crafted data, this can lead to remote code execution as the web server user (such as asterisk or www-data). The attacker does not need shell or CLI access or extra filesystem permissions beyond the normal restore workflow, but must authenticate with a username that has sufficient permissions or write access to backup files.
This vulnerability has been fixed in FreePBX versions 16.0.71 and 17.0.6.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with valid credentials and sufficient permissions to execute arbitrary code remotely on the server running FreePBX during the backup restore process.
Such remote code execution can lead to full compromise of the system under the web server user context, potentially allowing the attacker to manipulate the PBX system, access sensitive data, disrupt services, or use the compromised server as a foothold for further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade FreePBX to version 16.0.71 or 17.0.6 or later, where the issue has been fixed.
Ensure that only trusted users with sufficient access permissions can perform backup restore operations.
Avoid restoring backups from untrusted or unknown sources to prevent execution of malicious code.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows Remote Code Execution during backup restore operations if a malicious backup file is used. This could lead to unauthorized access or compromise of the system running FreePBX.
Such a compromise could potentially result in unauthorized access to sensitive data or disruption of services, which may impact compliance with standards and regulations like GDPR or HIPAA that require protection of personal and health information.
However, the provided information does not explicitly detail the direct impact on compliance with these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the FreePBX backup module improperly sanitizing data during restore operations, allowing Remote Code Execution if a malicious backup archive is restored.
Detection on your system can focus on identifying if vulnerable versions of FreePBX are in use (versions below 16.0.71 and 17.0.6) and monitoring backup restore activities for suspicious or unauthorized operations.
Since the vulnerability requires authentication with a user having sufficient permissions, reviewing user access logs and backup restore logs can help detect potential exploitation attempts.
- Check FreePBX version installed: Use commands like `fwconsole --version` or check the FreePBX admin interface to verify the version.
- Review web server logs (e.g., Apache or Nginx) for POST requests to the backup restore endpoint that might indicate restore operations.
- Audit user authentication and authorization logs to identify if users with backup restore permissions have performed unexpected restore operations.
- If possible, monitor or capture network traffic to detect suspicious uploads of backup tar archives to the restore endpoint.
No specific detection commands or signatures are provided in the available resources, so detection relies on version checking, log analysis, and monitoring restore activities.