FreePBX v1.6.2 Security Advisory: Template Injection, API Token Exposure, and Fix

Vulnerability Overview v1.6.1 Secure Release (Superseded by v1.6.2) - Issue Description: The script in v1.6.1 polluted the global object in FreePBX, breaking the standard upgrade path and causing SQL syntax errors. - Impact: The module table version upgrade was aborted, modules were disabled, and manual recovery was required. - Remediation: Use v1.6.2, which includes all security fixes from v1.6.1 along with the installation path fix. It can be installed directly or upgraded to via standard procedures. Impact Scope v1.6.1: - GHSA-pxfc-q7zv-jhbm (Critical, CVSS 9.9): Template parameter injection in via . - GHSA-9vfx-9qhs-p6cx (High, CVSS 7.4): API tokens stored in plaintext within . - GHSA-3p65-2pnr-ckt (Medium, CVSS 6.5): Persistent plaintext credentials in . - GHSA-65y8-fhnb-gq7c (Medium, CVSS 6.5): Silent erasure of voicemail/user data via . Remediation Upgrade to v1.6.2: - v1.6.2 includes all security fixes from v1.6.1 along with the installation path fix. It can be installed directly or upgraded to. - Existing API tokens remain valid and do not need to be reissued for authentication after the upgrade. - The operation for is irreversible. If audit log content from before the patch needs to be retained, it should be backed up and encrypted prior to upgrading. - now requires permissions. Read-only API tokens that previously could query audit logs will now be denied access and must be reissued with administrative scope. - now strictly validates template parameters. Existing valid templates are unaffected, but payloads containing newlines, backslashes, or placeholders will be rejected. Additional Information Disclosure: Four security advisories were disclosed on May 13, 2026, through responsible disclosure channels on the FreePBX community forum. Acknowledgments: Thanks to FreePBX community members, whose AI-assisted code review identified the root issues.

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX v1.6.2 Security Advisory: Template Injection, API Token Exposure, and Fix

More from this source