FreePBX up to 16.0.21/17.0.4 Dashboard class.php include rawname php file inclusion

Summaryinfo

A vulnerability identified as critical has been detected in FreePBX up to 16.0.21/17.0.4. This affects the function include of the file class.php of the component Dashboard Module. Performing a manipulation of the argument rawname results in php file inclusion. This vulnerability is known as CVE-2026-44239. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in FreePBX up to 16.0.21/17.0.4. It has been classified as critical. This affects the function include of the file class.php of the component Dashboard Module. The manipulation of the argument rawname with an unknown input leads to a php file inclusion vulnerability. CWE is classifying the issue as CWE-98. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs. This vulnerability is fixed in 16.0.22 and 17.0.5.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-44239 since 05/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:class.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 16.0.22 or 17.0.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• FreePBX

Version

• 16.0.0
• 16.0.1
• 16.0.2
• 16.0.3
• 16.0.4
• 16.0.5
• 16.0.6
• 16.0.7
• 16.0.8
• 16.0.9
• 16.0.10
• 16.0.11
• 16.0.12
• 16.0.13
• 16.0.14
• 16.0.15
• 16.0.16
• 16.0.17
• 16.0.18
• 16.0.19
• 16.0.20
• 16.0.21
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion