← Vulnerability feed

Vulnerability record · CVE-2025-59429 · published 14 October 2025

CVE-2025-59429: Sangoma freepbx cross-site scripting vulnerability

Sangoma · Freepbx

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17.

8.5 CVSS 4.0 High EPSS 0.19% · top 91.9% CWE-79 · Cross-site scripting
8.5CVSS 4.0 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-c8g7-475j-fwcc Vendor Advisory

Track CVE-2025-59429 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-57819FreePBX unauthenticated SQL injection and auth bypass to RCEFreePBX 15, 16 and 17 fail to sanitize user-supplied data, letting an unauthenticated attacker bypass authentication to the FreePBX Administrator int…KEVEPSS 85%analysed9.8CVE-2019-19006Sangoma FreePBX improper authentication allows remote admin bypassFreePBX versions 115.0.16.26, 14.0.13.11, 13.0.197.13 and below contain an incorrect access control flaw (CWE-287 improper authentication) that lets …KEVEPSS 56%analysed10.0CVE-2014-7235Freepbx code injection vulnerabilityhtdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.…EPSS 43%9.8CVE-2020-36630Sangoma freepbx sql injection vulnerabilityA vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.ph…EPSS 0.68%9.3CVE-2026-46376Sangoma freepbx hard-coded credentials vulnerabilityFreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP)…EPSS 0.50%9.3CVE-2025-66039Sangoma freepbx improper authentication vulnerabilityFreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the a…EPSS 3.3%8.8CVE-2023-43336Sangoma freepbx improper access control vulnerabilitySangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified param…EPSS 0.72%8.7CVE-2024-58294Sangoma freepbx os command injection vulnerabilityFreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to ex…EPSS 3.6%

Source: NIST National Vulnerability Database (record CVE-2025-59429), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.