VYPR
← All advisories
High severity8.8NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2026-28287

CVE-2026-28287

Description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

Affected products

3
  • Freepbx/Freepbx2 versions
    cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*range: >=16.0.17.2,<16.0.20
    • (no CPE)range: 16.0.17.2 to <16.0.20, 17.0.2.4 to <17.0.5
  • Freepbx/Security Reportingcpe-rescue
    Range: >= 16.0.17.2, < 16.0.20

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.