PT-2025-36096 · Freepbx · Freepbx Contactmanager Module

J0Eblow · Published 2025-09-04 · Updated 2025-09-05 · CVE-2025-55209

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions FreePBX contactmanager module versions 15.0.14 and below FreePBX contactmanager module versions 16.0.0 through 16.0.26 FreePBX contactmanager module versions 17.0.0 through 17.0.5

Description FreePBX contactmanager module contains a stored cross-site scripting (XSS) vulnerability. A low-privileged User Control Panel (UCP) user can inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, potentially leading to session hijacking and privilege escalation.

Recommendations FreePBX contactmanager module version 15.0.15 or later FreePBX contactmanager module version 16.0.27 or later FreePBX contactmanager module version 17.0.6 or later

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-55209

GHSA-J654-X3Q2-6WM3

Affected Products

Freepbx Contactmanager Module

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55209.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-55209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55209 · Security Note
• https://github.com/FreePBX/contactmanager/commit/55abba0f1ab5d66ba87732fd06179231d1f68184 · Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-j654-x3q2-6wm3 · Note
• https://t.me/cveNotify/134331 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1963791910620795217 · Twitter Post
• https://t.me/CVEtracker/31740 · Telegram Post
• https://twitter.com/CVEnew/status/1963827269719499219 · Twitter Post