FreePBX framework vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 20261

Newest CVEs

• CVE-2026-73661

  FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

  FreePBX · framework

  High8.6
• CVE-2025-67722

  Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

  FreePBX · framework

  Medium5.7
• CVE-2025-66039

  FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

  FreePBX · framework

  Critical9.3
• CVE-2025-59056

  FreePBX vulnerable to unauthenticated Denial of Service

  FreePBX · framework

  Medium6.6
• CVE-2025-55211

  FreePBX Post-Authenticated Command Injection

  FreePBX · framework

  Medium6.3