CVE WatchSep 28, 2026

CVE-2026-54675

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and con

CVSS

—

No CVSS

EPSS

0.6%

p47

KEV

—

Exploit Today

0-100

Published: Sep 28, 2026 · Last modified: Sep 28, 2026 · CWE-22 · CWE-73 · CWE-434

EPSS · 30d

Not enough EPSS history yet.

Technical description

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.

Official references

github.comhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-95gm-cmxf-cv8v

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-972426.8 MED

—

———Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.8h CVE-2026-968246.8 MED

—

———Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.8h CVE-2026-941237.5 HIG

—

———Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.8h CVE-2026-10739—

—

———Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.10h CVE-2026-10726—

—

———Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.10h CVE-2026-750987.5 HIG

—

———The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.8h