CVE-2026-44238: FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX CDR Reports moduleto a version that resolves this vulnerability.Fixed in 16.0.50 - Upgrade
Upgrade
FreePBX CDR Reports moduleto a version that resolves this vulnerability.Fixed in 17.0.11 - Configuration
Ensure the FreePBX Administration Control Panel account used for authentication has access limited to the CDR section; full administrator privileges are not required.
FreePBX Administration Control Panel Account permissions = Restrict to accounts with CDR section access (no full admin privileges required)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44238?
CVE-2026-44238 has a severity rating of high, with a CVSS score of 8.5.
How do I fix CVE-2026-44238?
To fix CVE-2026-44238, upgrade FreePBX to version 16.0.50 or 17.0.11 or later.
What type of vulnerability is CVE-2026-44238?
CVE-2026-44238 is an authenticated SQL injection vulnerability.
Who is affected by CVE-2026-44238?
Users of FreePBX prior to version 16.0.50 and 17.0.11 with access to the CDR Reports module are affected.
What can attackers do with CVE-2026-44238?
Attackers with authenticated access can exploit CVE-2026-44238 to execute arbitrary SQL commands via the CDR Reports module.