CVE-2026-44239 Details
Description
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.
A local file inclusion vulnerability has been identified in the FreePBX Dashboard module, affecting versions prior to 16.0.22 and 17.0.5. The issue arises in the 'getcontent' AJAX handler, where user-supplied input is used to include PHP files without proper path sanitization. This allows for path traversal attacks to include arbitrary '.class.php' files from the filesystem. The executed PHP code runs before any class instantiation errors occur, potentially leading to unauthorized command execution on the server as the web server user, typically 'asterisk'.
Users are advised to update the Dashboard module to the latest version. Additionally, access to the FreePBX Administrator Control Panel should be restricted to authorized users, and hostile network access should be denied, for example, by using the FreePBX Firewall module.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hw7v-v2jp-wc4v | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sangoma freepbx | < 16.0.22 >= 17.0, < 17.0.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 29, 2026 | New CVE Received | [email protected] |