CVE-2024-58294

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-27)

CWE

CWE-78

Published

2025-12-11

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

Affected

• sangoma:freepbx

References

• https://www.exploit-db.com/exploits/52031
• https://www.freepbx.org/
• https://www.vulncheck.com/advisories/freepbx-authenticated-remote-code-execution-via-api-module
• https://www.youtube.com/watch?v=rqFJ0BxwlLI

Check your stackJSON