CVE-2024-53564

7.2 highEPSS 0.3%

High (7.2) in sangoma freepbx. EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2024-12-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sangoma:freepbx

References

https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903
https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c

Check your stack JSON