CVE-2026-54708 is a high severity (CVSS 8.8) code execution flaw in the FreePBX backup module. Improper path sanitization during restore lets a PHP file land in the web root. It is fixed in backup module 16.0.72 for FreePBX 16 and 17.0.7 for FreePBX 17, so update before any further restore.
What's affected
The advisory lists the backup module.
- FreePBX 16: backup before 16.0.72. Fixed in 16.0.72.
- FreePBX 17: backup before 17.0.7. Fixed in 17.0.7.
The attacker needs a known username with enough access, and or write access to backup files. The impact is arbitrary command execution as the FreePBX service user.
Severity sources differ. The record scores it 8.8 (CVSS 3.1, High). The advisory scores it 8.6 (CVSS 4.0, High), threat-adjusted 6.2 (Medium).
How to check if you're exposed
On the PBX, list module versions from the command line:
fwconsole ma list | grep -i backup
Compare the version shown with the fixed versions above. You can also open Module Admin in the web interface and read the installed version there. If the module is below the fixed version for your FreePBX major release, treat the system as exposed to any account that meets the access condition in the advisory.
Because the risk sits in the restore step, also list where your backup archives are stored and who can write to those locations.
What to do now
- Update the
backupmodule before you perform any further restore operations, as the advisory says. - Limit access to the backup and restore modules to known, high-level trusted users.
- Restrict who can reach the control panel. The advisory suggests User Management, the SysAdmin VPN, MFA or SAML, and the FreePBX Firewall module to deny hostile networks.
- Review the custody chain of backup files, including copies stored outside FreePBX. The advisory suggests saving hashes of backups when they are taken so you can verify them later.
- Do not restore archives from sources you cannot verify.
Why it matters
The record lists CWE-22, path traversal, and CWE-94, code injection. The restore routine trusted paths inside a backup archive. A crafted archive can therefore write outside the intended directory and drop a PHP file into the web root.
The advisory notes this is similar to an issue from the month before, which is a reminder that a whole class of restore and upload handlers can share the same weakness. The practical control is to treat backup files as untrusted input unless you can prove where they came from. The record does not mark this CVE as known exploited.
Quick check
Why does the advisory talk about hashing backups?
A hash taken when the backup is created lets you confirm later that the file has not been swapped or edited before a restore.
Does updating the module fix archives already created?
The update fixes the restore handling. The advisory still recommends reviewing the origin of any backup file before you restore it.
Sources
Last reviewed: 18 October 2026.
