Blog

Commentary Posts to this category can cover a wide range of topics. The posts here are by FreePBX staff but typically reflect their direct opinions or views on issues that affect the community. Security This category contains posts related to security announcements and updates. Please review the FreePBX Security Policy on GitHub before posting here. There is also a FreePBX Security section of the forums. Infrastructure The infrastructure category will feature notices about changes to the plumbing behind FreePBX, including server maintenance, migrations, and other modifications. Often these messages are posted at trust.sangoma.com along with other Sangoma matters, but this category will help provide users with more focused subscription options for FreePBX-specific items. News This category contains general news updates from the FreePBX team, particularly those posted to the Official FreePBX Blog. One great way to follow these posts automatically is to set the alarm bell in the upper-right corner to “Watching First Post”.

Topic	Replies	Views	Activity
About the Blog category Blog	1	2053	October 22, 2024
:green_circle: Authenticated privilege escalation in API module via SQL injection in Pinsets Security security , v17 , v16 , graphql	0	6	September 29, 2026
:green_circle: Authenticated low-privilege UCP user can modify contacts of other users Security ucp , contact-manager , security , v17 , v16	0	4	September 29, 2026
:orange_circle: Authenticated low-privilege UCP user can read full database via SQL injection Security ucp , security , v17 , v16	0	5	September 29, 2026
:green_circle: Authenticated admin SQL injection via SIPSTATION module Security siptrunk , security , v17 , acp	0	4	September 29, 2026
:cowboy_hat_face: Telephony Cards: The Last Roundup, and What Comes Next News freepbx	0	63	September 18, 2026
Looking for a More Predictable Phone System than 3CX? Choose FreePBX :frog: Blog freepbx	0	69	September 18, 2026
:magnifying_glass_tilted_right: Searching for a Mitel Alternative? Consider FreePBX for your Business Blog freepbx	0	49	September 18, 2026
:green_circle: Authenticated Root OS Command Injection in Backup GraphQL restoreBackup Security security , v17 , v16 , graphql , restore-backup	0	35	September 17, 2026
:green_circle: Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection Security dialplan , security , v17 , v16 , acp	0	36	September 17, 2026
:green_circle: Authenticated RCE in UCP via AMI Security ucp , framework , security , v17 , v16	0	38	September 17, 2026
:green_circle: Authenticated admin can read any file via call recording report Security security , v17 , v16 , acp	0	33	September 17, 2026
:orange_circle: Authenticated RCE via unsafe unserialize in backup restore Security security , v17 , v16 , backup-restore	0	32	September 17, 2026
:orange_circle: Unauthenticated inbound CallerID becomes stored XSS in CEL Reports Security callerid , security , v17 , v16 , cel	0	45	September 17, 2026
:green_circle: Authenticated but Broken access control in the FreePBX framework GraphQL API Security framework , security , v17 , v16 , graphql	0	51	August 31, 2026
:green_circle: Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher Security framework , security , v17 , v16	1	44	September 23, 2026
:orange_circle: Authenticated RCE in FindMeFollowMe function of Sangoma Connect Security security , v17 , v16	1	47	September 23, 2026
:green_circle: Authenticated Backup Metadata Hooks Execution Bypass Security backup , security , v17 , v16 , backup-restore	1	39	September 23, 2026
:green_circle: Authenticated Backup GraphQL Restore Filename Command Injection Security backup , security , v17 , v16 , backup-restore	1	42	September 23, 2026
:orange_circle: Unauthenticated RCE via SQL injection in Sangoma Connect RT API login Security firewall , security , v17 , v16	1	74	September 20, 2026
:orange_circle: Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user's dashboard templates Security ucp , security , v17 , v16	1	70	September 20, 2026
Softphone access is changing as module licenses expire News commercialmodules , freepbx , pbxact	2	162	September 7, 2026
:orange_circle: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover Security security , v17 , v16 , missedcall	3	138	August 16, 2026
:red_circle: Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection Security ucp , security , v17	4	241	August 16, 2026
:green_circle: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup Security backup , security , v17 , v16 , backup-restore	1	53	August 15, 2026
:green_circle: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files Security moh , security , v17	1	52	August 15, 2026
:green_circle: Authenticated TTS AGI Command Injection Through TTS Name Security security , v17 , v16 , tts	1	57	August 15, 2026
Authenticated Arbitrary SSH Key Injection via Backup Module Security backup , v17	1	59	August 8, 2026
Authenticated API generatedocs Host Command Injection Security v17 , graphql	1	57	August 8, 2026
Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module Security asterisk , moh , security , v17 , v16	14	296	July 17, 2026