CVE-2026-54674: FreePBX UCP RCE Vulnerability

CVE-2026-54674 Overview

CVE-2026-54674 is an authenticated command injection vulnerability in FreePBX, an open source IP PBX platform. Authenticated users of the User Control Panel (UCP) can execute arbitrary commands on the PBX host as the webserver user, typically asterisk. The flaw stems from insufficient sanitization of specific URL parameters processed by UCP. Attackers can chain shell metacharacters through crafted HTTP requests to run binaries on the underlying operating system. FreePBX maintainers patched the issue in versions 16.0.39 and 17.0.7.

Critical Impact
Authenticated UCP users can execute arbitrary operating system commands as the asterisk webserver account, enabling full compromise of the PBX host, call records, and voice infrastructure.

Affected Products

FreePBX versions prior to 16.0.39
FreePBX versions prior to 17.0.7
FreePBX User Control Panel (UCP) module

Discovery Timeline

2026-09-28 - CVE-2026-54674 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-54674

Vulnerability Analysis

CVE-2026-54674 is an OS Command Injection vulnerability classified under [CWE-78]. The FreePBX UCP interface accepts URL parameters that are ultimately passed to shell contexts on the server. Insufficient input filtering allows attackers to inject shell metacharacters and command separators. When the crafted parameter reaches a system-level function, the injected commands run under the webserver identity, usually the asterisk user.

Attackers with any UCP account can invoke the vulnerable request path. UCP accounts are commonly issued to end users such as extension owners, whereas Administrator Control Panel (ACP) accounts are restricted to administrators. This lowers the effective privilege barrier compared to a typical admin-only issue.

Root Cause

The root cause is missing or incomplete sanitization of URL parameters handled by UCP request processors. The affected code paths did not neutralize characters such as ;, |, &, backticks, or command substitution sequences before those values were incorporated into shell invocations.

Attack Vector

Exploitation requires network access to the UCP endpoint and valid UCP credentials. An attacker authenticates to UCP, issues a crafted HTTP request containing shell metacharacters in a vulnerable URL parameter, and chains commands that the server executes as the webserver user. Successful exploitation yields arbitrary command execution against confidentiality and integrity of the PBX host. See the FreePBX GitHub Security Advisory GHSA-4jjr-8g5r-wv66 for advisory-level technical detail. No verified public proof-of-concept code was available at the time of writing.

Detection Methods for CVE-2026-54674

Indicators of Compromise

Unexpected child processes spawned by the FreePBX PHP or web server process running under the asterisk account
HTTP requests to UCP endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks in URL parameters
Outbound network connections initiated by asterisk to unfamiliar hosts, especially over ports 4444, 1337, or arbitrary ephemeral ports
New or modified files in web-writable directories such as /var/www/html/admin/modules/ or /tmp/

Detection Strategies

Enable verbose web server access logging on FreePBX and search for UCP request URIs carrying shell-injection patterns
Alert on any process execution where the parent is the FreePBX webserver and the child is a shell, curl, wget, nc, or scripting interpreter
Correlate UCP authentication events with subsequent unusual host-level command execution by the asterisk user

Monitoring Recommendations

Forward FreePBX web logs, Asterisk logs, and Linux auditd process events to a centralized SIEM for correlation
Baseline normal UCP HTTP parameter values and alert on deviations that include command-injection characters
Monitor the asterisk user account for unusual shell activity, cron modifications, or new SSH keys

How to Mitigate CVE-2026-54674

Immediate Actions Required

Upgrade FreePBX to version 16.0.39 or 17.0.7 or later
Restrict UCP network exposure to trusted internal networks and place UCP behind a VPN where possible
Audit existing UCP user accounts and disable unused or stale accounts
Rotate credentials for any accounts that could have been used to reach UCP prior to patching

Patch Information

FreePBX released fixed versions 16.0.39 and 17.0.7, which add sanitization for the affected UCP URL parameters. Administrators should apply the upgrade through the FreePBX module admin or the fwconsole utility. Full details are in the FreePBX GitHub Security Advisory GHSA-4jjr-8g5r-wv66.

Workarounds

Block external access to the UCP interface at the network perimeter or reverse proxy
Enforce strong, unique passwords and multi-factor authentication on all UCP accounts
Deploy a web application firewall rule that rejects UCP requests containing shell metacharacters in URL parameters

bash

# Upgrade FreePBX modules via the fwconsole utility
fwconsole ma upgradeall
fwconsole reload
fwconsole restart