CVE-2026-54675
Received Received - Intake

Arbitrary File Write to RCE in FreePBX

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-54675
EUVD
EUVD-2026-88388

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freepbx freepbx to 17.0.5 (exc)
freepbx freepbx to 16.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FreePBX versions before 16.0.10 and 17.0.5 allows authenticated attackers to write arbitrary files via path traversal during sound language upload and conversion. This can place malicious PHP files in the web server's root directory, enabling remote code execution with the privileges of the FreePBX service user.

Detection Guidance

Check FreePBX versions for 16.x below 16.0.10 or 17.x below 17.0.5. Inspect uploaded sound language files for unexpected PHP files in web root directories. Monitor for unauthorized file writes or suspicious processes running under the asterisk user.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your FreePBX system, potentially taking full control of the server. This could lead to data theft, system disruption, or further network compromise if the FreePBX service has elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Compliance may be compromised if the system processes personal or health information.

Mitigation Strategies

Update FreePBX to versions 16.0.10 or 17.0.5 or later. Restrict access to the FreePBX Administrator Control Panel. Remove any unauthorized PHP files from web root directories. Review file upload logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart