PT-2026-44843 · Freepbx · Freepbx

Mil1200 · CVE-2026-44238 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.50 FreePBX versions prior to 17.0.11

Description The CDR Reports module page allows SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This issue occurs through the order and sort POST parameters. Exploitation requires authentication with a FreePBX Administration Control Panel account that has access to the CDR section, although full administrator privileges are not necessary.

Recommendations Update to version 16.0.50. Update to version 17.0.11.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44238

GHSA-P9FQ-FMPW-2H9X

Affected Products

Freepbx

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44238.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44238 · Security Note
• https://twitter.com/ADKCyber/status/2060712460710248617 · Twitter Post
• https://t.me/cveNotify/208784 · Telegram Post