CVE-2025-59056— FreePBX vulnerable to unauthenticated Denial of Service
Quick assessment
Affected
FreePBX framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX 15版本、16版本和17版本存在路径遍历漏洞，该漏洞源于恶意连接可触发管理员控制面板的卸载功能，可能导致模块数据库表被删除。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-59056
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreePBX vulnerable to unauthenticated Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:L/U:Red
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
FreePBX 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX 15版本、16版本和17版本存在路径遍历漏洞，该漏洞源于恶意连接可触发管理员控制面板的卸载功能，可能导致模块数据库表被删除。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-59056
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59056
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: framework
-
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp -
CVE-2026-73661
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored Fr -
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settin
Same vendor: FreePBX
-
CVE-2026-75600
FreePBX: Authenticated API generatedocs Host Command Injecti -
CVE-2026-54710
FreePBX: Authenticated Superfecta Arbitrary PHP Code Executi -
CVE-2026-54708
Authenticated Remote Code Execution via Path Traversal in Fr -
CVE-2026-54675
FreePBX: Authenticated Remote Code Execution via File Upload -
CVE-2026-54674
Authenticated Command Injection in FreePBX UCP Interface
Same weakness: CWE-22
-
CVE-2026-104801
PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion vi -
CVE-2026-97348
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contrib -
CVE-2026-104763
Post Export Import with Media <= 1.17.1 - Authenticated (Adm -
CVE-2026-108258
Shiny for Python - Path traversal in bookmark restore -
CVE-2026-107844
Contao: Path traversal in the images controller
V. Comments for CVE-2025-59056
No comments yet