Arbitrary Command Execution in FreePBX by Authenticated Users
CVE-2025-55211

6.3MEDIUM

Key Information:

Vendor

Freepbx

Status
Security-reporting
Vendor
CVE Published:
15 September 2025

What is CVE-2025-55211?

FreePBX, a widely-used open-source web-based GUI for managing VoIP systems, is susceptible to a vulnerability that allows authenticated users of the Administrator Control Panel (ACP) to execute arbitrary shell commands. This issue arises when users manipulate the language settings within the framework module. The vulnerability has been addressed in version 17.0.21, which reinforces the system's defenses against unauthorized command execution.

Affected Version(s)

security-reporting >= 17.0.19.11, < 17.0.21

References

https://github.com/FreePBX/security-reporting/security/ad...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-55211 : Arbitrary Command Execution in FreePBX by Authenticated Users