Security readout for executives and security teams
Plain-English summary
FreePBX has a high-severity authenticated file inclusion flaw in its Dashboard module. A logged-in user could influence which PHP class file is included, causing PHP code in that file to run. This can threaten confidentiality and integrity, especially on systems with many administrative users or exposed management interfaces.
Executive priority
Prioritize remediation for internet-reachable or broadly administered FreePBX systems. The flaw needs authentication, but successful abuse can execute PHP from included class files and affect sensitive PBX management infrastructure. Patch promptly and tighten administrative exposure.
Technical view
The getcontent AJAX handler concatenates $_REQUEST['rawname'] into an include() path with a .class.php suffix and lacks path sanitization. Traversal sequences can include arbitrary .class.php files from the filesystem. The included PHP executes before the later class-instantiation failure. Fixed versions are 16.0.22 and 17.0.5.
Likely exposure
FreePBX systems running affected security-reporting/Dashboard module versions: below 16.0.22, or 17.0.1 through below 17.0.5. Exposure requires an authenticated user able to reach the vulnerable Dashboard AJAX handler.
Exploitation context
The source bundle does not show KEV listing or active exploitation evidence. Exploitation is authenticated, network-accessible, low complexity, and requires a precondition according to CVSS. Treat shared administrator accounts, weak account governance, or exposed management portals as risk amplifiers.
Researcher notes
Evidence is limited to the CVE record and GitHub advisory reference in the bundle. No CPEs are listed. The flaw is CWE-98 with CVSS 4.0 score 7.6. Do not assume arbitrary extension inclusion; the described include path appends .class.php.
Mitigation direction
- Upgrade affected FreePBX installations to 16.0.22 or 17.0.5.
- Review the FreePBX advisory for any additional vendor instructions.
- Restrict FreePBX administrative access to trusted networks or VPN users.
- Audit and remove unnecessary FreePBX accounts with Dashboard access.
- Monitor vendor channels for follow-up fixes or guidance.
Validation and detection
- Inventory FreePBX security-reporting/Dashboard module versions across all PBX systems.
- Confirm patched systems report version 16.0.22, 17.0.5, or later.
- Identify whether FreePBX admin interfaces are internet reachable.
- Review recent authenticated access and administrative activity for anomalies.
- Confirm no vulnerable versions remain in production, staging, or backups.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-98: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-44239 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
7.6HighVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hw7v-v2jp-wc4vCVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.