CVE-2026-54708: FreePBX Backup Module RCE Vulnerability

CVE-2026-54708 Overview

CVE-2026-54708 is a path traversal vulnerability [CWE-22] in the FreePBX backup module that leads to remote code execution. FreePBX is an open source IP PBX widely deployed for enterprise voice communications. The flaw affects versions prior to 16.0.72 and 17.0.7. Authenticated attackers with sufficient permissions can upload malicious PHP files to the web root by abusing improper path sanitization in the backup restore functionality. The FreePBX project patched the issue in versions 16.0.72 and 17.0.7.

Critical Impact
Authenticated attackers can write attacker-controlled PHP files into the web root and execute arbitrary code on the FreePBX server, resulting in full compromise of the telephony infrastructure.

Affected Products

FreePBX versions prior to 16.0.72
FreePBX versions prior to 17.0.7
FreePBX backup module (restore functionality)

Discovery Timeline

2026-09-28 - CVE-2026-54708 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-54708

Vulnerability Analysis

The vulnerability resides in the backup restore workflow of the FreePBX administration interface. When processing a backup archive, the module fails to properly sanitize file paths extracted from the archive. An authenticated user with permission to restore backups can craft an archive containing entries that traverse outside the intended restore directory. Because the resulting write target can be the web-facing document root, attackers can drop a PHP payload that is subsequently executed by the web server. Exploitation requires valid credentials for an account with backup or write access, but no user interaction is needed beyond initiating a restore.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, tracked as [CWE-22]. The backup restore routine trusts the file paths embedded in the restore payload without normalizing or validating them against the intended destination. This allows path components such as .. sequences or absolute paths to redirect writes to arbitrary locations, including the FreePBX web root.

Attack Vector

The attack is network-reachable through the FreePBX administrative web interface. An authenticated attacker uploads a malicious backup archive whose internal file entries reference a path outside the restore staging directory. When the restore executes, a PHP file is written into a location served by the web server. The attacker then requests the file over HTTP, causing the PHP interpreter to execute the payload with the privileges of the web server user. See the GitHub Security Advisory GHSA-5hhg-w366-g6fh for vendor-provided technical details.

Detection Methods for CVE-2026-54708

Indicators of Compromise

Unexpected .php files appearing in the FreePBX web root or module directories with recent modification timestamps.
Backup restore operations initiated by non-administrator accounts or from unusual source IP addresses.
Web server access logs showing HTTP requests to newly created PHP files immediately after a restore action.
Outbound network connections originating from the FreePBX web server process (for example, apache or www-data) to unknown hosts.

Detection Strategies

Audit the FreePBX admin/modules/backup logs for restore operations and correlate against expected administrative activity.
Monitor file integrity on the FreePBX web root and module paths to flag unauthorized PHP file creation.
Inspect uploaded backup archive contents for path entries containing .. sequences or absolute paths before applying restores.

Monitoring Recommendations

Enable and centralize FreePBX application and web server logs, then alert on restore actions performed outside change windows.
Track process lineage from the web server user to detect unexpected shell or scripting interpreter spawns after HTTP requests.
Alert on new listening sockets or reverse shell patterns originating from the PBX host.

How to Mitigate CVE-2026-54708

Immediate Actions Required

Upgrade FreePBX to version 16.0.72 or 17.0.7 (or later) as soon as possible.
Review and reduce the number of accounts that hold backup and restore privileges in the FreePBX admin interface.
Rotate credentials for all administrative accounts and audit recent backup restore activity for signs of abuse.
Inspect the web root for unauthorized PHP files and remove any that cannot be attributed to legitimate modules.

Patch Information

The FreePBX maintainers addressed the path sanitization flaw in versions 16.0.72 and 17.0.7. Administrators should apply these updates through the standard FreePBX module admin update process. Refer to the FreePBX security advisory GHSA-5hhg-w366-g6fh for release notes and upgrade guidance.

Workarounds

Restrict network access to the FreePBX administrative interface using firewall rules or a VPN until patches are applied.
Temporarily revoke backup module access for all non-essential administrative accounts.
Disable the backup module in environments where it is not required for daily operations.
Place the FreePBX admin UI behind an authenticating reverse proxy that enforces additional access controls.

bash

# Configuration example: restrict access to the FreePBX admin UI via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify installed FreePBX version after upgrade
fwconsole ma list | grep -i backup