CVE-2026-44239: FreePBX: Authenticated Local File Inclusion in Dashboard Module

Synopsis

Authenticated local file inclusion in the FreePBX Dashboard module. The getcontent AJAX handler concatenates the user-supplied rawname parameter into a PHP include() call with a .class.php suffix, letting an attacker with a low-privilege FreePBX account traverse the filesystem with ../ sequences and execute the PHP contents of any .class.php file before the class instantiation error halts execution. Successful exploitation reads sensitive configuration and executes attacker-influenced PHP, exposing the FreePBX admin interface and its credentials. A patched-image rebuild at 16.0.22 or 17.0.5 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FreePBX admin web interface over the network.

• AuthenticationRequired

  A low-privilege FreePBX account with access to the Dashboard module's AJAX endpoint is sufficient.

• Victim interactionNot required

  The handler is invoked directly by the attacker and needs no action from another user.

• Attack complexityDetail

  AC:L indicates a reliable exploit, though AT:P notes a present attack requirement tied to the targeted file layout.

Blast Radius

• Reads arbitrary .class.php files from the filesystem, exposing FreePBX configuration, database credentials, and module internals.
• Executes the PHP contents of any included file under the web server account before the class instantiation error fires, enabling code paths the attacker would not normally reach.
• Pivots from a low-privilege FreePBX login toward full admin compromise of the PBX, including call routing and SIP trunk credentials.