Vulnerability in Freepbx Security-Reporting
CVE-2026-44239
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.
EPSS: 0.003 (19.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Freepbx Security-reporting — versions < 16.0.22, >= 17.0.1, < 17.0.5
- Sangoma Freepbx
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-44239?
- CVE-2026-44239 is a high-severity vulnerability in Freepbx Security-Reporting, classified under PHP Remote File Inclusion. CVSS score: 8.8/10. Published 2026-05-29.
- How severe is CVE-2026-44239?
- High severity. CVSS v3 base score is 8.8 out of 10.