Home

Description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

PUBLISHED Reserved 2026-02-26 | Published 2026-03-05 | Updated 2026-03-09 | Assigner GitHub_M




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

>= 16.0.17.2, < 16.0.20
affected

>= 17.0.2.4, < 17.0.5
affected

References

github.com/...orting/security/advisories/GHSA-9vv6-h8v6-rp4q

cve.org (CVE-2026-28287)

nvd.nist.gov (CVE-2026-28287)

Download JSON