Executive brief
FreePBX is an open-source communication platform used for managing IP-based phone systems. A security vulnerability in its backup and restore module allows an authorized user to execute malicious code on the server by uploading a specially crafted backup file. This could lead to a full system compromise, allowing an attacker to intercept communications or disrupt phone services.
Technical details
A deserialization vulnerability (CWE-502) exists in the FreePBX backup module's restore functionality. During the restoration process, the application extracts files from a user-provided tar archive and passes the contents of manifest files directly to the PHP unserialize() function without prior validation or class restrictions. An attacker with sufficient privileges to perform a restore or write access to backup files can craft a malicious archive containing a PHP gadget chain to achieve Remote Code Execution (RCE). The exploit runs with the privileges of the web server user (typically 'asterisk' or 'www-data'). The issue is resolved in versions 16.0.71 and 17.0.6 by implementing json_decode() and restricting unserialize() options.
Affected products
- FreePBX FreePBX Backup Module < 16.0.71, < 17.0.6
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: CVE published to NVD