Loading vulnerability…
Authenticated Arbitrary File Upload in FreePBX Endpoint Manager Firmware Upload
CVE-2025-61678 is an authenticated arbitrary file upload vulnerability in the FreePBX Endpoint Manager module affecting versions prior to 16.0.92 for FreePBX 16 and prior to 17.0.6 for FreePBX 17. The flaw is present in the firmware upload functionality and is tied to improper handling of the fwbrand parameter, which can be manipulated to alter the destination file path. This enables an authenticated attacker with a known username to upload arbitrary files to attacker-controlled locations on the server. In practical exploitation, the issue can be used to place a server-executable webshell within a web-accessible directory, turning the upload flaw into remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to write arbitrary files to chosen paths on the target server. If the attacker can place executable script content in a location processed by the web server, the vulnerability can be escalated to remote code execution and full compromise of the FreePBX instance. Secondary impacts can include persistence, unauthorized access to sensitive application and system data, modification of server-side content, and use of the compromised PBX host as a pivot point for further intrusion.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the firmware upload functionality by restricting access to Endpoint Manager administrative interfaces to trusted users and trusted network locations only. Minimize the number of accounts able to reach the vulnerable upload feature, enforce strong authentication hygiene, and monitor for suspicious file upload activity and unexpected server-side file creation. Since this vulnerability is authenticated, preventing unauthorized access to valid usernames and administrative sessions materially reduces risk, but mitigation is not a substitute for upgrading to a fixed version.
Patch, then assume compromise.
Upgrade the FreePBX Endpoint Manager module to a fixed release. The vulnerability is patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17. Organizations should update affected systems immediately and verify that all Endpoint Manager components are running the corrected version. Because exploitation may result in arbitrary file placement and webshell deployment, post-upgrade response should include a review for unauthorized server-side files, unexpected modifications in web-accessible locations, and other signs of compromise.
4 exploits validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.