PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44239 FreePBX CVE debrief

A path traversal vulnerability in FreePBX Dashboard module's getcontent AJAX handler allows authenticated attackers to execute arbitrary PHP code. The vulnerability exists because the `$_REQUEST['rawname']` parameter is unsafely concatenated into an `include()` call with a `.class.php` suffix, permitting directory traversal via `../` sequences. Successful exploitation requires the attacker to identify or place a `.class.php` file containing malicious PHP code at a predictable filesystem location accessible through traversal. The vulnerability affects FreePBX versions prior to 16.0.22 and 17.0.5.

Vendor
FreePBX
Product
security-reporting
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

FreePBX administrators, VoIP security teams, and organizations running on-premise PBX infrastructure should prioritize this vulnerability. The attack requires low privileges and has high confidentiality and integrity impact, making it attractive for attackers who have gained any level of authenticated access to the FreePBX web interface.

Technical summary

The FreePBX Dashboard module contains a vulnerable getcontent AJAX handler that performs unsafe file inclusion. The handler takes a user-supplied `rawname` parameter and directly concatenates it into an `include()` statement with a hardcoded `.class.php` extension. Without proper path sanitization, an attacker can inject directory traversal sequences (`../`) to escape the intended module directory and include arbitrary `.class.php` files from the filesystem. When PHP includes a file, the code executes immediately, allowing attackers to achieve code execution even if subsequent class instantiation fails. This represents a classic Local File Inclusion (LFI) vulnerability with code execution impact due to PHP's include behavior.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade FreePBX to version 16.0.22 or 17.0.5 or later to remediate this vulnerability
  • If immediate patching is not possible, restrict access to the Dashboard module's AJAX endpoints to trusted administrative IP addresses
  • Review web server logs for requests to the getcontent AJAX handler containing path traversal patterns (../ sequences) in the rawname parameter
  • Audit filesystem for unexpected .class.php files in web-accessible or predictable locations that could be leveraged for code execution
  • Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in AJAX requests to the Dashboard module

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-hw7v-v2jp-wc4v. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high impact to confidentiality and integrity. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) classified as primary weakness.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44239 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44239

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44239 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44239

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.