FreePBX vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20241
3. 202516
4. 202624

Known exploitedNewest addition to KEV first

• CVE-2025-64328

  FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

  FreePBX · filestore

  ExploitedHigh8.6
• CVE-2025-57819

  FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

  FreePBX · endpoint

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-75600

  FreePBX: Authenticated API generatedocs Host Command Injection

  FreePBX · security-reporting

  High8.6
• CVE-2026-54710

  FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

  FreePBX · security-reporting

  High8.6
• CVE-2026-54708

  Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

  FreePBX · security-reporting

  High8.6
• CVE-2026-54675

  FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

  FreePBX · security-reporting

  High8.7
• CVE-2026-54674

  Authenticated Command Injection in FreePBX UCP Interface

  FreePBX · security-reporting

  High8.6
• CVE-2026-45562

  FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

  FreePBX · security-reporting

  High7.7
• CVE-2026-73665

  FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

  FreePBX · ucp

  Critical9.3
• CVE-2026-73664

  FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module

  FreePBX · backup

  High8.6
• CVE-2026-73663

  FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

  FreePBX · missedcall

  Critical9.3
• CVE-2026-73662

  Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

  FreePBX · music

  High7.6