# CVE-2026-26978: FreePBX Backup Module insecure deserialization in restore operation

Source: https://junglewise.ai/threats/cve-2026-26978-freepbx-backup-module-insecure-deserialization-in-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-26978 · Severity: info · CVSS 8.6 · Published 2026-05-18

FreePBX is an open-source communication platform used for managing IP-based phone systems. A security vulnerability in its backup and restore module allows an authorized user to execute malicious code on the server by uploading a specially crafted backup file. This could lead to a full system compromise, allowing an attacker to intercept communications or disrupt phone services.

Vendors: [FreePBX](https://junglewise.ai/threats/vendors/freepbx).

## Quick answers

**Is CVE-2026-26978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26978 being exploited in the wild.

**How severe is CVE-2026-26978?** Informational severity, with a CVSS score of 8.6, published 18 May 2026.

**Which products and versions are affected?** FreePBX Backup Module < 16.0.71, < 17.0.6.

**Is there a fix for CVE-2026-26978?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26978 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-26978?** Check whether you run FreePBX Backup Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability (CWE-502) exists in the FreePBX backup module's restore functionality. During the restoration process, the application extracts files from a user-provided tar archive and passes the contents of manifest files directly to the PHP unserialize() function without prior validation or class restrictions. An attacker with sufficient privileges to perform a restore or write access to backup files can craft a malicious archive containing a PHP gadget chain to achieve Remote Code Execution (RCE). The exploit runs with the privileges of the web server user (typically 'asterisk' or 'www-data'). The issue is resolved in versions 16.0.71 and 17.0.6 by implementing json_decode() and restricting unserialize() options.

## Affected products

- FreePBX FreePBX Backup Module < 16.0.71, < 17.0.6

## Timeline

- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: CVE published to NVD

## References

- [https://github.com/FreePBX/backup/commit/45c57e1207cbf9fd1c5f76f8a3e72d204a69a472](https://github.com/FreePBX/backup/commit/45c57e1207cbf9fd1c5f76f8a3e72d204a69a472)
- [https://github.com/FreePBX/backup/commit/64781af5c80cce0cff21a981be4d8e6a7a71f2c4](https://github.com/FreePBX/backup/commit/64781af5c80cce0cff21a981be4d8e6a7a71f2c4)
- [https://github.com/FreePBX/security-reporting/security/advisories/GHSA-5v7h-49gr-jcwr](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-5v7h-49gr-jcwr)