Web-based Interface Vulnerability in FreePBX from Sangoma
CVE-2025-59056

6.6MEDIUM

Key Information:

Vendor

Freepbx

Status
Security-reporting
Vendor
CVE Published:
15 September 2025

What is CVE-2025-59056?

The FreePBX web-based graphical user interface is susceptible to malicious attacks that exploit vulnerabilities in the Administrator Control Panel. Specifically, attackers can initiate unauthorized module uninstallation, resulting in the loss of critical module database tables where configuration settings are stored. This vulnerability has been addressed in subsequent releases: 15.0.38, 16.0.41, and 17.0.21, ensuring enhanced security and stability for users.

Affected Version(s)

security-reporting < 15.0.38 < 15.0.38

security-reporting >= 16.0.0, < 16.0.41 < 16.0.0, 16.0.41

security-reporting >= 17.0.0, < 17.0.21 < 17.0.0, 17.0.21

References

https://github.com/FreePBX/security-reporting/security/ad...
x_refsource_CONFIRM
https://github.com/FreePBX/framework/blame/release/17.0/a...
x_refsource_MISC

CVSS V4

Score:
6.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59056 : Web-based Interface Vulnerability in FreePBX from Sangoma