Read the docs
TI-2026-21457 Aliases CVE-2026-26978

Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php

Priority MEDIUM 41CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00896 59th percentileScored 2026-11-07
Fix Fixed security-reporting (FreePBX): 16.0.71, 17.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreePBXsecurity-reportingbefore 16.0.71; 17.0.0 to before 17.0.616.0.71, 17.0.6Patch availableCNA
  • security-reporting VendorFreePBX Affected before 16.0.71; 17.0.0 to before 17.0.6 Fixed in 16.0.71, 17.0.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*——Sangoma
  • cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:* Versions — — ·Sangoma

Remediation

  • Fix · CNA security-reporting (FreePBX) Fixed in 16.0.71, 17.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26978

References

Other 3

  • TI-2025-35702 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE KEVCVSS 4.0CRITICAL 10.0
  • TI-2025-39763 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection KEVCVSS 4.0HIGH 8.6
  • TI-2024-38391 FreePBX 16 Authenticated Remote Code Execution via API Module CVSS 4.0HIGH 8.7
  • TI-2014-06023 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface… CVSS 2.0HIGH 10.0
  • TI-2025-36981 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page CVSS 4.0HIGH 8.5
  • TI-2025-38110 FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter CVSS 4.0HIGH 8.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences