CVE-2025-55211— FreePBX Post-Authenticated Command Injection
Quick assessment
Affected
FreePBX framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX 17.0.19.11版本至17.0.21之前版本存在操作系统命令注入漏洞，该漏洞源于框架模块语言设置不当，可能导致执行任意shell命令。
Possible ATT&CK Techniques 1 AI
T1059.004 · Unix Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-55211
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreePBX Post-Authenticated Command Injection
Source: CVE Program / CVE List V5
Vulnerability Description
FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Green
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
FreePBX 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX 17.0.19.11版本至17.0.21之前版本存在操作系统命令注入漏洞，该漏洞源于框架模块语言设置不当，可能导致执行任意shell命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-55211
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-55211
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: framework
-
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp -
CVE-2026-73661
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored Fr -
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settin
Same vendor: FreePBX
-
CVE-2026-75600
FreePBX: Authenticated API generatedocs Host Command Injecti -
CVE-2026-54710
FreePBX: Authenticated Superfecta Arbitrary PHP Code Executi -
CVE-2026-54708
Authenticated Remote Code Execution via Path Traversal in Fr -
CVE-2026-54675
FreePBX: Authenticated Remote Code Execution via File Upload -
CVE-2026-54674
Authenticated Command Injection in FreePBX UCP Interface
Same weakness: CWE-78
-
CVE-2026-101947
ExifTool for photo and video 5.0.1 - Local OS command inject -
CVE-2026-55797
Argo CD repo-server command injection via crafted SSH reposi -
CVE-2026-84057
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-107780
Dromara Skyeye Unauthenticated OS Command Injection via text -
CVE-2026-106126
Command Injection
V. Comments for CVE-2025-55211
No comments yet