Arbitrary Command Execution in FreePBX by Authenticated Users
CVE-2025-55211

6.3MEDIUM

Key Information:

Vendor

Freepbx

Status
Security-reporting
Vendor
CVE Published:
15 September 2025

What is CVE-2025-55211?

FreePBX, a widely-used open-source web-based GUI for managing VoIP systems, is susceptible to a vulnerability that allows authenticated users of the Administrator Control Panel (ACP) to execute arbitrary shell commands. This issue arises when users manipulate the language settings within the framework module. The vulnerability has been addressed in version 17.0.21, which reinforces the system's defenses against unauthorized command execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

security-reporting >= 17.0.19.11, < 17.0.21

References

https://github.com/FreePBX/security-reporting/security/ad...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.