CVE-2026-54674 is a high severity (CVSS 8.8) OS command injection in the FreePBX User Control Panel. A user who can log in to UCP can run commands on the PBX as the web server user, usually asterisk. It is fixed in FreePBX 16.0.39 and 17.0.7.
What's affected
The advisory lists the UCP module for both FreePBX major releases.
- FreePBX 16: versions before 16.0.39. Fixed in 16.0.39.
- FreePBX 17: versions before 17.0.7. Fixed in 17.0.7.
Authenticated access to UCP is required. The advisory points out that UCP access is usually given to far more people than the Administrator Control Panel, including ordinary extension users, so the pool of accounts that could reach this flaw is larger than the admin list.
Severity sources differ. The record scores it 8.8 (CVSS 3.1, High). The GitHub advisory scores it 8.6 (CVSS 4.0, High) with a threat-adjusted score of 6.2 (Medium).
How to check if you're exposed
On the PBX, list module versions from the command line:
fwconsole ma list | grep -i -e ucp -e userman
Compare the version shown with the fixed versions above. You can also open Module Admin in the web interface and read the installed version there. If the module is below the fixed version for your FreePBX major release, treat the system as exposed to any account that meets the access condition in the advisory.
The advisory names the ucp module in its affected list and tells you to update the userman module in its mitigations, so check both. Also review which accounts have UCP access at all.
What to do now
- Update the
ucpandusermanmodules in Module Admin to the latest versions, at least 16.0.39 or 17.0.7. - Limit UCP access to known, trusted users.
- Put UCP behind User Management, the SysAdmin VPN, MFA or SAML where you can.
- Use the FreePBX Firewall module to deny access to UCP from hostile networks.
- Review the PBX host for unexpected processes or files owned by the asterisk user if UCP was reachable from the internet.
Why it matters
The cause is CWE-78, OS command injection. Certain URL parameters used by UCP were not sanitized well enough, so specially crafted values could end up running binaries on the host. The advisory says an earlier fix in 2023 was insufficient and that the underlying problem likely dates back to the early days of UCP.
This is a good example of why exposure depends on who can log in, not only on the version. A flaw that needs "any user" is a different risk from one that needs "an administrator". The record does not flag this CVE as known exploited.
Quick check
Is UCP the same as the admin panel?
No. UCP is the user-facing panel and is usually available to many more people than the Administrator Control Panel. That is why the advisory stresses limiting UCP access.
Which user does the command run as?
The web server user, typically asterisk, according to the advisory.
Sources
Last reviewed: 18 October 2026.
