CVE-2025-1131: Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-23 · updated 2026-10-19
Weakness: CWE-427

Description

A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.

Affected products

asterisk: before 18.26.3; from 20.0.0 before 20.15.1; from 21.0.0 before 21.10.1; from 22.0.0 before 22.5.1 — fixed in 18.26.3, 20.15.1, 21.10.1, 22.5.1
Sangoma Certified Asterisk: 18.9-cert1, 18.9-cert1-rc1, 18.9-cert10, 18.9-cert11, 18.9-cert12, 18.9-cert13 (+20)

How to fix

Upgrade to a fixed version: asterisk 18.26.3, 20.15.1, 21.10.1, 22.5.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-1131 or the next vulnerability affects your stack