PT-2025-37764 · Freepbx · Freepbx

Pwniverse · Published 2025-09-15 · Updated 2025-10-17 · CVE-2025-59056

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreePBX versions 15.0.0 through 15.0.37 FreePBX versions 16.0.0 through 16.0.40 FreePBX versions 17.0.0 through 17.0.20

Description FreePBX is a web-based graphical user interface. Malicious connections to the Administrator Control Panel web interface can trigger the uninstall function for certain modules. This function removes the module’s database tables, which store the module’s configuration.

Recommendations Update FreePBX to version 15.0.38 or later. Update FreePBX to version 16.0.41 or later. Update FreePBX to version 17.0.21 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-16263

CVE-2025-59056

GHSA-FRC2-JHGG-RWPR

Affected Products

Freepbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59056.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59056 · Security Note
• https://bdu.fstec.ru/vul/2025-16263 · Security Note
• https://github.com/FreePBX/framework/blame/release/17.0/amp_conf/htdocs/admin/ajax.php#L18 · Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-frc2-jhgg-rwpr · Note
• https://t.me/cveNotify/139146 · Telegram Post
• https://twitter.com/CVEnew/status/1967819572897067219 · Twitter Post