Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

Description

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.

Scores

EPSS (exploitation in 30 days)

0.13% · top 98% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.

Weakness

• CWE-426: Untrusted Search Path (opens in a new tab)All about CWE-426 and its CVEs

Affected products

• FreePBX · framework

  • affected < 16.0.45
  • affected >= 17.0.0, < 17.0.24

References (2)

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8 (opens in a new tab)x_refsource_CONFIRM
• https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-67722](https://trackcve.app/badge/CVE-2025-67722.svg)](https://trackcve.app/cve/CVE-2025-67722)

Record last updated 26 Feb 2026, 16:07 UTC.