CVE-2026-54675 is a high severity (CVSS 8.8) path traversal and file upload flaw in the FreePBX soundlang module. An authenticated user can write files into the web root and reach remote code execution. It is fixed in soundlang 16.0.10 for FreePBX 16 and 17.0.5 for FreePBX 17.
What's affected
The advisory lists the soundlang module.
- FreePBX 16: soundlang before 16.0.10. Fixed in 16.0.10.
- FreePBX 17: soundlang before 17.0.5. Fixed in 17.0.5.
A known username is required. The impact is arbitrary command execution as the FreePBX service user, typically asterisk.
Severity sources differ. The record scores it 8.8 (CVSS 3.1, High). The advisory scores it 8.6 (CVSS 4.0, High) and a threat-adjusted 6.2 (Medium). The advisory text calls the flaw critical in prose while its own score is High.
How to check if you're exposed
On the PBX, list module versions from the command line:
fwconsole ma list | grep -i soundlang
Compare the version shown with the fixed versions above. You can also open Module Admin in the web interface and read the installed version there. If the module is below the fixed version for your FreePBX major release, treat the system as exposed to any account that meets the access condition in the advisory.
What to do now
- Update the
soundlangmodule to 16.0.10 or 17.0.5 or later. - Restrict who can reach the control panel. The advisory suggests User Management, the SysAdmin VPN, MFA or SAML, and the FreePBX Firewall module to deny hostile networks.
- Check the web root of the PBX for PHP files you did not put there, especially any recently created.
- Review which accounts can upload sound language packs and remove access that is not needed.
Why it matters
The record lists CWE-22 (path traversal), CWE-434 (unrestricted file upload) and CWE-73 (external control of a file name or path). The file conversion step did not sanitize paths well enough, so a crafted upload could place a PHP file in the web server root, where the server would run it.
The advisory says the issue was introduced in 2016 as part of a large patch. Old code paths in long-lived products often hide this kind of bug, which is why upgrades matter even when nothing looks wrong. It is not marked as known exploited in the record.
Quick check
Why does a file write lead to code execution?
Because the file lands in the web server root and is a PHP file, the web server will run it when it is requested. That turns a write primitive into command execution.
Is the sound language module needed on every PBX?
It ships with FreePBX, but you should check your own deployment. Either way, update it, because the advisory names it as the vulnerable component.
Sources
Last reviewed: 18 October 2026.
