CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often more common for less-privileged users to have UCP access vs. the Administrator Control Panel (ACP) access (which is usually FreePBX higher-level administrator accounts only). Insufficient sanitization of certain URL parameters utilized by UCP did not fully account for malicious strings in these fields. This could result in binaries being executed on the host server by carefully chaining commands. This issue has been patched in versions 16.0.39 and 17.0.7.

• CWE-78

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-4jjr-8g5r-wv66

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54666swagger-typescript-api generates API clients for Fetch or Ax…8.3
• CVE-2026-5467A vulnerability was identified in Casdoor 2.356.0. Affected …6.1
• CVE-2026-54670WeGIA is a web manager for charitable institutions. Prior to…9.1
• CVE-2026-54671WeGIA is a web manager for charitable institutions. Prior to…8.8
• CVE-2026-54672electron-updater allows for automatic updates for Electron a…7.8
• CVE-2026-54673electron-updater allows for automatic updates for Electron a…6.5
• CVE-2026-54675FreePBX is an open source IP PBX. Prior to versions 16.0.10 …8.7
• CVE-2026-54676Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54677Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54679jq is a command-line JSON processor. Prior to 1.8.2, on 32bi…5.5
• CVE-2026-5468A security flaw has been discovered in Casdoor 2.356.0. This…5.4
• CVE-2026-54680Logging operator automates the deployment and configuration …9.9