Authenticated Command Injection and Arbitrary SSH Key Injection in FreePBX 17

72% confidence

Description

Multiple vulnerabilities in FreePBX 17 including an authenticated API host command injection and an authenticated arbitrary SSH key injection via the Backup module.

Affected Products

Vendor	Product	Versions
sangoma technologies	freepbx	< 17.0.9 (API), < 17.0.11 (Backup)

Related News (1 articles)

Tier B

CCCS Canada1h ago

FreePBX security advisory (AV26-680)

→ No new info (linked only)

CISA KEV❌ No

Actively exploited❌ No

Patch available

17.0.11

CWECWE-77, CWE-284

PublishedJul 9, 2026

Last enriched57m ago

Authenticated Command Injection and Arbitrary SSH Key Injection in FreePBX 17

Description

Affected Products

Related News (1 articles)

Community Vote

Related CVEs (4)

Pin to Dashboard

Verification

Vulnerability Timeline