CVE-2025-57819

Timeline

Detection, updates, and resolution for this record.

1. Aug 28, 2025 · Catalog

   Detected

   FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

2. Aug 29, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Sep 19, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Sep 25, 2026 · Catalog

   Updated

   FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Affected

• cpe sangoma/freepbxversion unspecified
• vendor Sangoma FreePBXversion unspecified

Sources

• CISA KEVCVE-2025-57819

  Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

  cisa.gov
• CVE.orgCVE-2025-57819

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2025-57819

  30-day exploitation probability 86.3%

  first.org
• Exploit Database52681

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit Modulesexploit_unix/http/freepbx_unauth_sqli_to_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2025-57819

  FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code exe

  nvd.nist.gov

References

• Issue Tracking · community.freepbx.org
• CISA note · github.com
• Exploit · github.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov