CVE-2026-26978
Published: 18 May 2026
Summary
CVE-2026-26978 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
FreePBX is an open source IP PBX whose backup module, in versions below 16.0.71 and 17.0.6, fails to sanitize data during restore operations. The module extracts files from a user-supplied tar archive and passes selected contents directly to unserialize() without validation, class restrictions, or integrity checks, enabling remote code execution as the web server user (typically asterisk or www-data). The flaw is tracked as CWE-502 and carries a CVSS 4.0 score of 8.6.
An authenticated attacker who possesses a username with sufficient restore permissions, or who can write to backup files, can upload a malicious tar archive containing crafted serialized data. Restoration of that archive triggers code execution without requiring shell access, CLI access, or additional filesystem write rights beyond the normal restore workflow. The attack is entirely remote over the network.
The issue is resolved in FreePBX backup module versions 16.0.71 and 17.0.6, as noted in the project’s GitHub commits and the accompanying GHSA-5v7h-49gr-jcwr advisory. The EPSS score remains flat at 0.0102 with no material increase after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30810
Vulnerability details
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations,…
more
FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-502 deserialization flaw in public-facing FreePBX web restore workflow directly enables unauthenticated-style RCE (post-auth) on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.