CVE-2026-54710 is a high severity (CVSS 8.8) remote code execution flaw in the FreePBX superfecta module. It includes PHP files based on user-supplied input. Authenticated users can then run code as the web server user. It is fixed in 16.0.40 and 17.0.7.
What's affected
The advisory lists the superfecta module.
- FreePBX 16: before 16.0.40. Fixed in 16.0.40.
- FreePBX 17: before 17.0.7. Fixed in 17.0.7.
A known username is required. The advisory ties exploitation to the AJAX handler cases named options and save_options, and notes that it can be combined with other weaknesses such as arbitrary directory creation in the backup module and file uploads that reveal full paths in the soundlang module. Patching all three FreePBX issues from the same September batch closes that chain.
Severity sources differ. The record scores it 8.8 (CVSS 3.1, High). The advisory scores it 8.6 (CVSS 4.0, High), threat-adjusted 6.2 (Medium).
How to check if you're exposed
On the PBX, list module versions from the command line:
fwconsole ma list | grep -i superfecta
Compare the version shown with the fixed versions above. You can also open Module Admin in the web interface and read the installed version there. If the module is below the fixed version for your FreePBX major release, treat the system as exposed to any account that meets the access condition in the advisory.
Since the advisory describes a chain with the backup and soundlang modules, check those two as well. Related CVEs are CVE-2026-54708 and CVE-2026-54675.
What to do now
- Update the
superfectamodule to 16.0.40 or 17.0.7 or later. - Update the
backupandsoundlangmodules too, because the advisory describes them as part of an exploitation chain. - Restrict who can reach the control panel. The advisory suggests User Management, the SysAdmin VPN, MFA or SAML, and the FreePBX Firewall module to deny hostile networks.
- Review the web server user's files and the sources directory of Superfecta for anything unexpected.
Why it matters
The record lists CWE-20, improper input validation, and CWE-94, code injection. The code built a file path from user input and then included that PHP file. If an attacker can get their own PHP file onto the server and learn its path, including it means running it.
The lesson is about chains. This flaw is hard to use alone, but other modules in the same product supply the missing steps. Fixing one component without the others leaves part of the chain intact. The record does not flag this CVE as known exploited.
Quick check
Is Superfecta exploitable on its own?
The advisory describes it as combined with directory creation and file upload issues from other modules. Treat all three as one problem and patch them together.
Which user runs the injected code?
The web server user, typically asterisk or www-data per the advisory.
Sources
Last reviewed: 18 October 2026.
