Remote Code Execution Risk in FreePBX Backup Module
CVE-2026-26978
What is CVE-2026-26978?
The FreePBX backup module contains a flaw in how it handles data during restore operations. Specifically, in versions prior to 16.0.71 and 17.0.6, the backup restoration process lacks adequate data sanitization, allowing maliciously crafted files within user-supplied tar archives to be executed. When a backup restore operation is initiated, these files can be directly passed to the unserialize() function without proper validation or integrity checks. This vulnerability can lead to Remote Code Execution under the privileges of the web server user, making it possible for an attacker to exploit this issue without needing shell or filesystem write permissions. Sufficient authentication and user access are prerequisites for this vulnerability to be exploited.
Affected Version(s)
security-reporting < 16.0.71 < 16.0.71
security-reporting >= 17.0.0, < 17.0.6 < 17.0.0, 17.0.6