What’s Vulnerable › Vulnerabilities

CVE-2025-59056: FreePBX vulnerable to unauthenticated Denial of Service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-15 · updated 2026-06-17
• Weakness: CWE-22

Description

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.

Affected products

• Sangoma FreePBX: from 15.0 before 15.0.38; from 16.0 before 16.0.41; from 17.0 before 17.0.21 — fixed in 15.0.38, 16.0.41, 17.0.21

How to fix

Upgrade to a fixed version: Sangoma FreePBX 15.0.38, 16.0.41, 17.0.21. Check the vendor advisory for mitigations.

References

• https://github.com/FreePBX/framework/blame/release/17.0/amp_conf/htdocs/admin/ajax.php#L18
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-frc2-jhgg-rwpr

Get alerted when CVE-2025-59056 or the next vulnerability affects your stack