NuytsTech Security

CVE-2026-44238

by ·

FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.

More information : https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p9fq-fmpw-2h9x

Tags: