CVE-2026-26978: FreePBX Backup Module RCE Vulnerability

CVE-2026-26978 Overview

CVE-2026-26978 is an insecure deserialization vulnerability [CWE-502] in the FreePBX backup module. FreePBX is an open source IP PBX platform widely used for managing Asterisk-based telephony deployments. The flaw exists in versions below 16.0.71 and 17.0.6, where the backup module fails to sanitize data during restore operations. During restore, FreePBX extracts files from a user-supplied tar archive and passes content directly to PHP's unserialize() function without validation, class restrictions, or integrity checks. An authenticated attacker with sufficient permissions to perform a backup restore can achieve Remote Code Execution as the web server user, typically asterisk or www-data.

Critical Impact

Authenticated attackers can execute arbitrary code on FreePBX servers by uploading a crafted backup archive, gaining control of the telephony platform as the web server user.

Affected Products

• FreePBX backup module versions below 16.0.71
• FreePBX backup module versions below 17.0.6
• Asterisk-based PBX deployments using the FreePBX backup component

Discovery Timeline

• 2026-05-18 - CVE-2026-26978 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-26978

Vulnerability Analysis

The vulnerability stems from unsafe handling of serialized PHP objects within the FreePBX backup restore workflow. When an administrator initiates a restore, the backup module extracts selected files from a user-supplied tar archive. The module then reads specific files from the archive and passes their contents directly to PHP's unserialize() function. No class allowlist, integrity verification, or input validation occurs before deserialization.

This behavior matches the classic PHP Object Injection pattern. An attacker crafts a tar archive containing a malicious serialized payload that references PHP classes implementing magic methods such as __wakeup() or __destruct(). When unserialize() reconstructs these objects, the magic methods trigger gadget chains that culminate in arbitrary code execution under the web server account.

Root Cause

The root cause is the direct invocation of unserialize() on attacker-controlled data without the allowed_classes option or equivalent safeguards. PHP's native deserialization mechanism instantiates any class available in the runtime, allowing exploitation through gadget chains present in FreePBX modules and bundled libraries. The fix introduced in versions 16.0.71 and 17.0.6 addresses this by restricting deserialization and validating archive contents.

Attack Vector

Exploitation requires authenticated access with permissions to perform backup restore operations or write access to backup files. The attacker uploads a malicious tar archive through the normal restore workflow. The attack does not require shell access, CLI access, or filesystem write permissions beyond the standard restore process. Code execution occurs as the web server user, typically asterisk or www-data, granting access to call recordings, SIP credentials, and the underlying Asterisk runtime.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-5v7h-49gr-jcwr and the GitHub Commit Fix for technical details on the patched code paths.

Detection Methods for CVE-2026-26978

Indicators of Compromise

• Unexpected backup restore events in FreePBX administrative logs, especially from accounts that do not normally perform restores.
• New or modified PHP files in FreePBX module directories following a restore operation.
• Outbound network connections from the asterisk or www-data process to unfamiliar hosts.
• Tar archives with unusual file entries or oversized serialized blobs uploaded to the backup directory.

Detection Strategies

• Monitor FreePBX audit logs for restore actions and correlate with the authenticated user, source IP, and archive filename.
• Inspect tar archives staged for restore for files containing PHP serialized object markers such as O: followed by class names.
• Alert on child processes spawned by the web server user that are inconsistent with normal Asterisk and FreePBX operations.

Monitoring Recommendations

• Enable verbose logging on the FreePBX backup module and forward logs to a centralized SIEM for correlation.
• Track file integrity on /var/www/html/admin/modules/backup/ and the Asterisk configuration tree.
• Review administrative account activity for newly granted backup or restore privileges.

How to Mitigate CVE-2026-26978

Immediate Actions Required

• Upgrade the FreePBX backup module to version 16.0.71 or 17.0.6, or later, as published by the FreePBX project.
• Audit administrative accounts and remove backup and restore permissions from users that do not require them.
• Review recent restore operations and inspect the system for signs of unauthorized code execution.

Patch Information

The FreePBX maintainers released fixes in backup module versions 16.0.71 and 17.0.6. The relevant commits are documented in the GitHub Commit Update and the GitHub Commit Fix. Apply updates through the FreePBX Module Admin interface or the fwconsole ma upgrade backup command.

Workarounds

• Restrict access to the FreePBX administrative interface using network-level controls such as VPN or IP allowlisting.
• Disable the backup module on systems that do not require restore functionality until the patch is applied.
• Enforce strong authentication and unique credentials for all FreePBX administrative accounts to limit the pool of users that could trigger the vulnerable code path.

# Configuration example: upgrade the backup module via fwconsole
fwconsole ma upgrade backup
fwconsole reload
fwconsole ma list | grep backup