Read the docs

FreePBX

Records56All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high29CVSS 7.0–8.9

Exploited now

FreePBX records in CISA KEV
TI-2025-39763 Sangoma FreePBX OS Command Injection Vulnerability Priority CRITICAL 96KEV 2026-02-03TI-2025-35702 Sangoma FreePBX Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2025-08-29

Components

Products in the NVD configurations · select one to filter the records
Freepbx 9 records HIGH Api 1 record MEDIUM Contactmanager 1 record LOW Disa 1 record LOW Manager 1 record LOW

Records

1 record in Api · all components

TI-2026-29267 CVE-2026-40520 · GHSA-h2vx-h73q-6q6w

FreePBX api module Command Injection via GraphQL

Priority MEDIUM 42

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization o…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01379 Published 2026-04-21 Fixed CWE-78
Open these records in search →