FreePBX Recording Module Allows Malicious Code Execution

Summary

FreePBX's recording module has a security flaw that can allow hackers to inject malicious commands, potentially leading to unauthorized access or system damage. This issue affects FreePBX versions 16.0.17.2 to 16.0.20 and 17.0.2.4 to 17.0.5. Update to the latest version to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
sangoma	freepbx	> 16.0.17.2 , <= 16.0.20	–
sangoma	freepbx	> 17.0.2.4 , <= 17.0.5	–

Original title

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. Th...

Original description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

nvd CVSS3.1 8.8

nvd CVSS4.0 8.6

Vulnerability type

CWE-78 OS Command Injection

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9vv6-h8v6... Mitigation Vendor Advisory