Vulnerability in Freepbx Framework
CVE-2025-67722
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.001 (2.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Freepbx Framework — versions < 16.0.45, >= 17.0.0, < 17.0.24
- Sangoma Freepbx
Weakness classification (CWE)
References
- github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8 (Vendor Advisory)
- www.freepbx.org/watch-what-we-do-with-security-fixes-👀 (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-67722?
- CVE-2025-67722 is a high-severity vulnerability in Freepbx Framework, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2025-12-16.
- How severe is CVE-2025-67722?
- High severity. CVSS v3 base score is 7.8 out of 10.