FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE

Published:

15 december 2025 om 14:32:00

Alert date:

15 december 2025 om 15:01:25

Source:

thehackernews.com

Enterprise Applications, Zero-Day Vulnerabilities, Identity & Access

Multiple critical security vulnerabilities were discovered in FreePBX, an open-source private branch exchange platform. The flaws include a critical authentication bypass vulnerability (CVE-2025-61675) with a CVSS score of 8.6, along with SQL injection and file upload vulnerabilities that can lead to remote code execution. The vulnerabilities were discovered by Horizon3.ai and reported to maintainers on September 15, 2025. FreePBX has released patches to address these security issues.

Technical details

Multiple vulnerabilities in FreePBX including: 1) CVE-2025-61675 - Authenticated SQL injection vulnerabilities impacting four endpoints (basestation, model, firmware, custom extension) with 11 affected parameters enabling read/write database access. 2) CVE-2025-61678 - Authenticated arbitrary file upload vulnerability allowing PHP web shell upload via firmware upload endpoint after obtaining valid PHPSESSID. 3) CVE-2025-66039 - Authentication bypass when Authorization Type is set to 'webserver', allowing login via forged Authorization header. The bypass requires specific Advanced Settings to be enabled: Display Friendly Name, Display Readonly Settings, and Override Readonly Settings all set to 'Yes'.

Mitigation steps:

Update to patched versions: 16.0.92/17.0.6 (for CVE-2025-61675 and CVE-2025-61678) or 16.0.44/17.0.23 (for CVE-2025-66039). Set Authorization Type to 'usermanager', set 'Override Readonly Settings' to 'No', apply configuration and reboot system to disconnect rogue sessions. Analyze systems for compromise if webserver AUTHTYPE was previously enabled. Avoid using 'webserver' authentication type as it appears to be legacy code with reduced security.

Affected products:

FreePBX (versions before 16.0.92 and 17.0.6 for CVE-2025-61675 and CVE-2025-61678)
FreePBX (versions before 16.0.44 and 17.0.23 for CVE-2025-66039)