PT-2026-41736 · Freepbx · Freepbx

Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-26978

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.71 FreePBX versions prior to 17.0.6

Description The backup module fails to properly sanitize data during restore operations. When extracting files from a user-supplied tar archive, the system reads malicious files and passes them directly to the unserialize() function without validation, class restrictions, or integrity checks. This can lead to Remote Code Execution (RCE) under the privileges of the web server user, such as asterisk or www-data. Exploitation requires authentication with a username possessing sufficient permissions and write access to backup files. The attack does not require shell access, CLI access, or filesystem write permissions outside the standard restore process.

Recommendations Update to version 16.0.71 or later. Update to version 17.0.6 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-26978

Affected Products

Freepbx

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-26978 · Security Note
• https://github.com/FreePBX/backup/commit/45c57e1207cbf9fd1c5f76f8a3e72d204a69a472 · Note
• https://github.com/FreePBX/backup/commit/64781af5c80cce0cff21a981be4d8e6a7a71f2c4 · Note
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-5v7h-49gr-jcwr · Note
• https://twitter.com/infoflowcloud/status/2056671593275834849 · Twitter Post
• https://t.me/cveNotify/163928 · Telegram Post
• https://t.me/CVEtracker/54173 · Telegram Post
• https://twitter.com/CVEnew/status/2056670124061675974 · Twitter Post
• https://twitter.com/ADKCyber/status/2056776410413322395 · Twitter Post