Executive brief
FreePBX is an open-source IP phone system used by organizations to manage voice communications. An authenticated administrator can inject arbitrary SSH public keys into the system, granting persistent remote access to an attacker who compromises the admin account. This allows complete control over the phone system, including call interception, data theft, and service disruption.
Technical details
The FreePBX Backup module exposes an unauthenticated AJAX endpoint (publicKeySave) in Backup.class.php that accepts and appends SSH public keys directly to /home/asterisk/.ssh/authorized_keys without enforcing backup-specific command or source restrictions. The vulnerability requires authenticated administrator-level access, but once a legitimate admin session is compromised (via phishing, credential reuse, or other means), an attacker can inject arbitrary SSH keys to establish persistent remote code execution. The attacker gains shell access as the asterisk system user, enabling arbitrary command execution, access to call records and configuration files, and potential privilege escalation. The vulnerability was introduced in 2024 as part of UI convenience improvements and is fixed in version 17.0.11.
Affected products
- FreePBX FreePBX 17.0.5.34 to 17.0.10
Timeline
- 2026-07-09: disclosed: GitHub Security Advisory GHSA-24w6-hpg3-rwfg published
- 2026-08-13: disclosed: NVD entry CVE-2026-73664 published
- 2026: patched: Fixed in FreePBX 17.0.11