CVE-2025-67722

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.

• CWE-426

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p42w-v77m-hfp8Vendor Advisory
• https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67717ZITADEL is an open-source identity infrastructure tool. Vers…4.3
• CVE-2025-67718Form.io is a combined Form and API platform for Serverless a…8.7
• CVE-2025-67719Ibexa is a composable end-to-end DXP (Digital Experience Pla…8.5
• CVE-2025-6772A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2…7.5
• CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
• CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67726Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67727Parse Server is an open source backend that can be deployed …9.8
• CVE-2025-67728Fireshare facilitates self-hosted media and link sharing. Ve…9.8