What is CVE-2025-55211?

CVE-2025-55211 is a high-severity vulnerability in Freepbx Framework, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-09-15.

How severe is CVE-2025-55211?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Freepbx Framework

CVE-2025-55211

FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framewo…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.004 (31.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Freepbx Framework — versions >= 17.0.19.11, < 17.0.21
Sangoma Freepbx

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2025-55211?: CVE-2025-55211 is a high-severity vulnerability in Freepbx Framework, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-09-15.
How severe is CVE-2025-55211?: High severity. CVSS v3 base score is 8.8 out of 10.