Read the docs
TI-2025-34884 Aliases CVE-2025-55209

FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX allows a low-privileged User Control Panel (UCP) user to inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, leading to session hijacking and potential privilege escalation. This issue is fixed in versions 15.0.14, 16.0.27 and 17.0.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed contactmanager (FreePBX): 15.0.14, 16.0.27, 17.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreePBXcontactmanagerbefore 15.0.14; 16.0.0 to before 16.0.27; 17.0.0 to before 17.0.615.0.14, 16.0.27, 17.0.6Patch availableCNA
  • contactmanager VendorFreePBX Affected before 15.0.14; 16.0.0 to before 16.0.27; 17.0.0 to before 17.0.6 Fixed in 15.0.14, 16.0.27, 17.0.6 Patch available CNA

Remediation

  • Fix · CNA contactmanager (FreePBX) Fixed in 15.0.14, 16.0.27, 17.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55209

References

Other 2

  • TI-2025-35702 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE KEVCVSS 4.0CRITICAL 10.0
  • TI-2025-39763 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection KEVCVSS 4.0HIGH 8.6
  • TI-2024-38391 FreePBX 16 Authenticated Remote Code Execution via API Module CVSS 4.0HIGH 8.7
  • TI-2014-06023 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface… CVSS 2.0HIGH 10.0
  • TI-2025-36981 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page CVSS 4.0HIGH 8.5
  • TI-2025-38110 FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter CVSS 4.0HIGH 8.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences