CVE-2026-44238

FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sangoma:freepbx::::::::
	cpe:2.3:a:sangoma:freepbx::::::::

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) FreePBX es una PBX IP de código abierto. Antes de 16.0.50 y 17.0.11, la página del módulo de Informes CDR permite inyección SQL a través de los parámetros POST order y sort. Se requiere autenticación con una cuenta del Panel de Control de Administración de FreePBX que tenga acceso a la sección CDR. No se necesitan privilegios de administrador completos. Esta vulnerabilidad está corregida en 16.0.50 y 17.0.11.

01 Jun 2026, 18:41

Type	Values Removed	Values Added
First Time		Sangoma freepbx Sangoma
References	~~() https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x -~~	() https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x - Mitigation, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:a:sangoma:freepbx::::::::

29 May 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 14:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-44238

Mitre link : CVE-2026-44238

CVE.ORG link : CVE-2026-44238

JSON object : View

Products Affected

sangoma

freepbx

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-44238", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44238", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreePBX", "product": "security-reporting", "versions": [{"status": "affected", "version": "< 16.0.50"}, {"status": "affected", "version": ">= 17.0.1, < 17.0.11"}]}]}], "published": "2026-05-29T14:16:27.233", "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11."}, {"lang": "es", "value": "FreePBX es una PBX IP de c\u00f3digo abierto. Antes de 16.0.50 y 17.0.11, la p\u00e1gina del m\u00f3dulo de Informes CDR permite inyecci\u00f3n SQL a trav\u00e9s de los par\u00e1metros POST order y sort. Se requiere autenticaci\u00f3n con una cuenta del Panel de Control de Administraci\u00f3n de FreePBX que tenga acceso a la secci\u00f3n CDR. No se necesitan privilegios de administrador completos. Esta vulnerabilidad est\u00e1 corregida en 16.0.50 y 17.0.11."}], "lastModified": "2026-07-21T12:10:00.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C008D8A-5192-4D70-9241-F4F613169CFF", "versionEndExcluding": "16.0.50"}, {"criteria": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75F770D7-C403-4592-94A1-4A2BA8B53553", "versionEndExcluding": "17.0.11", "versionStartIncluding": "17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}