FreePBX security advisory (AV26-484)

Serial number: AV26-484
Date: May 20, 2026

On May 19, 2026, FreePBX published security advisories to address vulnerabilities in the following products:

• FreePBX Security-Reporting cdr (FreePBX 16) – versions 16.0.50 and prior
• FreePBX Security-Reporting cdr (FreePBX 17) – versions 17.0.11 and prior
• FreePBX Security-Reporting dashboard (FreePBX 16) – versions 16.0.22 and prior
• FreePBX Security-Reporting dashboard (FreePBX 17) – versions 17.0.5 and prior

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• Authenticated SQL Injection via ORDER BY in CDR Reports
• Authenticated Local File Inclusion in Dashboard Module
• FreePBX Security Advisories