CVE-2026-54674: Authenticated Command Injection in FreePBX UCP Interface
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often more common for less-privileged users to have UCP access vs. the Administrator Control Panel (ACP) access (which is usually FreePBX higher-level administrator accounts only). Insufficient sanitization of certain URL parameters utilized by UCP did not fully account for malicious strings in these fields. This could result in binaries being executed on the host server by carefully chaining commands. This issue has been patched in versions 16.0.39 and 17.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBXto a version that resolves this vulnerability.Fixed in 16.0.39 - Upgrade
Upgrade
FreePBXto a version that resolves this vulnerability.Fixed in 17.0.7
Event History
Frequently Asked Questions
Which accounts are relevant to exploitation?
An attacker needs an authenticated FreePBX User Control Panel (UCP) account. UCP access may be available to less-privileged users who do not have access to the Administrator Control Panel.
What level of access can successful exploitation provide?
A successful attacker can execute arbitrary commands on the PBX host as the webserver user, typically asterisk. Exploitation is performed through specially crafted HTTP strings targeting insufficiently sanitized UCP URL parameters.
Which releases contain the fix?
The issue is patched in FreePBX versions 16.0.39 and 17.0.7. Versions earlier than those releases are affected according to the advisory.