FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter

Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. The fwbrand parameter allows an attacker to change the file path. Combined, these issues can result in a webshell being uploaded. Authentication with a known username is required to exploit this vulnerability. Successful exploitation allows authenticated users to upload arbitrary files to attacker-controlled paths on the server, potentially leading to remote code execution. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.

Scores

EPSS (exploitation in 30 days)

45.6% · top 1.2% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

• CWE-434: Unrestricted Upload of File with Dangerous Type (opens in a new tab)All about CWE-434 and its CVEs

Affected products

• FreePBX · endpointman

  • affected < 16.0.92
  • affected >= 17.0.0, < 17.0.6

References (1)

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-7p8x-8m3m-58j9 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-61678](https://trackcve.app/badge/CVE-2025-61678.svg)](https://trackcve.app/cve/CVE-2025-61678)

Record last updated 26 Feb 2026, 16:57 UTC.