FreePBX backup module Authenticated RCE via Path Traversal (GHSA-5hgh-w366-gfth)

FreePBX Backup Module Remote Code Execution Vulnerability (GHSA-5hgh-w366-gfth) Vulnerability Overview Vulnerability Type: Authenticated Remote Code Execution Cause: Path Traversal Description: The FreePBX module contains a critical vulnerability that allows an authenticated attacker (with sufficient privileges or write access to backup files) to execute arbitrary code on the server. Mechanism: Due to improper path sanitization in the backup restoration functionality, malicious attackers can upload malicious PHP files to the web root directory. CVSS Score: 8.6 (High) Scope of Impact Affected Component: FreePBX module Affected Versions: (FreePBX 16): (FreePBX 17): Execution Privileges: Typically executes arbitrary OS commands as the FreePBX service user (e.g., ). Remediation Fixed Versions: (FreePBX 16): (FreePBX 17): Mitigation Measures: Update the module to the latest version before performing any restoration operations. Restrict access to the FreePBX administration console only to authorized users (via FreePBX user management, Systemd VPM, MPA, or SAML modules). Limit access to backup and restore modules exclusively to known, highly trusted users. Use the FreePBX firewall module to block high-risk access from trusted host networks (e.g., ACP). Verify the integrity and chain of custody of backup files, including those stored outside of FreePBX, and validate hash values when retrieving backups. Related Code/POC None: No POC code or exploit code is included in the screenshot referenced.

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX backup module Authenticated RCE via Path Traversal (GHSA-5hgh-w366-gfth)

More from this source