CVE-2026-44239: FreePBX Path Traversal Remote Code Execution (8.8 HIGH)

Technical summary

The Dashboard module's getcontent AJAX handler concatenates the user-supplied $_REQUEST['rawname'] parameter directly into an include() statement with a .class.php suffix, creating a classic path traversal vulnerability. An attacker can inject ../ sequences to traverse the filesystem and specify arbitrary .class.php files for inclusion. Since PHP code in the included file is executed during the include operation, arbitrary code execution occurs before any subsequent class instantiation error. The vulnerability affects FreePBX versions prior to 16.0.22 and 17.0.5. The vector requires network access and valid authentication (PR:L), making this a post-authentication remote code execution flaw.

Business impact

Compromise of a FreePBX instance through this vulnerability grants an authenticated attacker full server code execution, potentially leading to theft of call records and voicemail, manipulation of call routing, deployment of malware, lateral movement into the corporate network, or complete system takeover. For organizations relying on FreePBX for unified communications, this represents a critical availability and confidentiality risk. Even with the authentication requirement, insider threats or compromised user credentials significantly lower the barrier to exploitation.

Affected systems

FreePBX versions 16.x prior to 16.0.22 and 17.x prior to 17.0.5 are vulnerable. Organizations should verify their exact installed version. The vulnerability affects the Dashboard module specifically, so systems with the Dashboard module active are at risk. Any deployment where untrusted or insufficiently privileged users have FreePBX login access should be considered vulnerable if unpatched.

Exploitability

Exploitability is high despite the authentication requirement. The attack surface is the getcontent AJAX endpoint, which does not require administrative privileges—any authenticated user can trigger it. No user interaction is needed (UI:N), and the attack is network-accessible (AV:N) with low attack complexity (AC:L). An attacker need only send a crafted HTTP request with a malicious rawname parameter. Proof-of-concept exploitation is straightforward for anyone with basic familiarity with path traversal and PHP execution contexts.

Remediation

Upgrade FreePBX to version 16.0.22 or later if on the 16.x branch, or to version 17.0.5 or later if on the 17.x branch. Verify the installed version before patching to ensure the upgrade targets the correct branch. After patching, restart the FreePBX service and confirm the Dashboard module is functioning correctly. As an interim measure, restrict network access to the FreePBX web interface using firewall rules or VPN to limit exposure to authenticated users within controlled networks only.

Patch guidance

Check your current FreePBX version via the System Administration > Module Admin interface or by querying the system directly. For version 16.x systems, apply the 16.0.22 update or later. For version 17.x systems, apply the 17.0.5 update or later. Consult the official Sangoma FreePBX security advisory and release notes to verify patch availability for your branch and installation method (source, distro packages, or cloud deployment). Test patches in a non-production environment first to ensure compatibility with local customizations or third-party modules.

Detection guidance

Monitor web server access logs for POST requests to the getcontent AJAX handler containing the rawname parameter with ../ sequences or unusual file paths. Watch for HTTP requests that include directory traversal patterns in request parameters. Inspect FreePBX application logs for unexpected class instantiation errors or PHP warnings that may indicate exploitation attempts. Configure intrusion detection rules to flag requests containing multiple consecutive ../ patterns in URL parameters. Endpoint detection and response (EDR) solutions should alert on unexpected PHP process spawning or file access originating from the web server process.

Why prioritize this

The CVSS 8.8 HIGH severity, combined with post-authentication remote code execution capability and widespread FreePBX deployment in small-to-medium business environments, warrants immediate attention. The low attack complexity and lack of user interaction make this highly exploitable by anyone with valid credentials. Organizations should prioritize patching based on network exposure and the sensitivity of communications data stored in their FreePBX instance.

Risk score, explained

The 8.8 score reflects the combination of high confidentiality, integrity, and availability impact (C:H, I:H, A:H) achievable through remote code execution, network accessibility (AV:N), and low complexity (AC:L). The requirement for prior authentication (PR:L) prevents a 9.0+ critical rating, but this should not provide false confidence—the authentication barrier is often easily overcome through compromised credentials, social engineering, or insider threats. The unified scope (S:U) indicates the compromise is limited to the vulnerable FreePBX system itself, though that system's role in communications infrastructure could indirectly affect other assets.

Frequently asked questions