CVE-2026-44239: FreePBX: Authenticated Local File Inclusion in Dashboard Module
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX Dashboard moduleto a version that resolves this vulnerability.Fixed in 16.0.22 - Upgrade
Upgrade
FreePBX Dashboard moduleto a version that resolves this vulnerability.Fixed in 17.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44239?
The severity of CVE-2026-44239 is high, with a CVSS score of 7.6.
How do I fix CVE-2026-44239?
To fix CVE-2026-44239, upgrade to FreePBX version 16.0.22 or 17.0.5 or later.
What type of vulnerability is CVE-2026-44239?
CVE-2026-44239 is an authenticated local file inclusion vulnerability.
What software is affected by CVE-2026-44239?
The affected software includes Sangoma FreePBX versions prior to 16.0.22 and 17.0.5.
What can attackers achieve with CVE-2026-44239?
Attackers can exploit CVE-2026-44239 to include arbitrary PHP files on the server due to path traversal vulnerabilities.