CVE-2025-61678

What it actually does

The flaw is an authenticated arbitrary file upload and path manipulation issue in the FreePBX Endpoint Manager module. The vulnerable fwbrand parameter can be abused to alter the destination path for uploaded content, allowing an authenticated user with a known username and sufficient privileges to place attacker-controlled files in unintended server locations. If the uploaded file is placed under a web-accessible PHP execution path, the attacker can create a webshell and achieve remote code execution in the context of the web server or FreePBX application user. The provided affected-product metadata lists Ubuntu LibreOffice packages, which conflicts with the vulnerability description; remediation should be based on the FreePBX Endpoint Manager versions identified in the advisory unless vendor package mapping confirms otherwise.

Why it matters to the business

A compromised FreePBX server can directly affect voice operations, including call routing, voicemail, SIP trunking, endpoint provisioning, and administrative access to the phone system. Successful exploitation could allow an attacker to run commands on the PBX host, maintain persistence through a webshell, steal configuration secrets, pivot into adjacent systems, disrupt telephony services, or enable toll fraud. Although exploitation requires authentication, the EPSS score is elevated and exploit maturity is listed as weaponized, so internet-exposed or broadly accessible FreePBX administration interfaces should be treated as high priority even though the issue is not currently listed in CISA KEV or associated with ransomware campaigns.

How an attack unfolds

An attacker first obtains valid FreePBX credentials or identifies an existing account they can use. After authenticating to the FreePBX administrative interface, the attacker accesses Endpoint Manager functionality that accepts file upload or branding-related input. By manipulating the fwbrand parameter, the attacker changes the upload destination so that a crafted file is written to an attacker-chosen path, commonly a web-accessible directory. If the file contains server-side script content and the destination permits execution, the attacker then sends an HTTP request to the uploaded file to execute commands on the PBX server. From there, the attacker may enumerate FreePBX configuration, collect credentials or SIP secrets, alter telephony settings, install persistence, or use the server as a foothold for lateral movement.

How to fix it

Upgrade the FreePBX Endpoint Manager module to a fixed version: FreePBX 16 deployments should use Endpoint Manager 16.0.92 or later, and FreePBX 17 deployments should use Endpoint Manager 17.0.6 or later. Restrict access to the FreePBX administrative interface to trusted management networks or VPN users only, and enforce MFA where supported. Review Endpoint Manager permissions and remove unnecessary administrative access. If immediate patching is not possible, disable or remove the Endpoint Manager module until the update can be applied, block direct internet access to the FreePBX admin interface, and add web server controls to prevent execution of uploaded files in writable directories. The input package list references LibreOffice Ubuntu fixes, which do not align with this FreePBX vulnerability; do not rely on LibreOffice package updates as a fix for this issue unless a vendor advisory explicitly maps them to the same vulnerability.

How to confirm the fix worked

Confirm the installed Endpoint Manager module version from the FreePBX module administration interface or command-line module tooling and verify it is at least 16.0.92 on FreePBX 16 or 17.0.6 on FreePBX 17. Confirm the FreePBX administrative interface is not publicly reachable unless intentionally protected by compensating controls such as VPN, allowlisting, and MFA. Review web server configuration to ensure uploaded content directories are not executable. Perform a file integrity review of FreePBX web directories for recently added PHP files, unexpected writable paths, and files owned by the web server user. Validate that requests attempting path traversal or unusual fwbrand values are rejected after the update. If the conflicting LibreOffice package data appears in vulnerability management tooling, verify the scanner plugin or advisory mapping to avoid false remediation conclusions.

Typical attack path

1. Identify a reachable FreePBX administrative interface with the Endpoint Manager module installed.
2. Obtain or reuse valid FreePBX credentials for an account capable of accessing Endpoint Manager functionality.
3. Authenticate to the FreePBX web interface.
4. Submit a crafted Endpoint Manager request that manipulates the fwbrand parameter to influence the upload path.
5. Upload attacker-controlled content to a web-accessible or otherwise executable location on the server.
6. Request the uploaded file over HTTP to execute server-side code or validate command execution.
7. Use the resulting access to enumerate configuration, harvest secrets, modify PBX settings, or establish persistence.
8. Cover tracks by deleting uploaded files, modifying timestamps, or reducing obvious log entries.

How to detect it

Investigate whether exploitation already occurred by correlating FreePBX authentication events, web server access logs, FreePBX application logs, filesystem changes, and process execution telemetry. Focus on authenticated sessions that accessed Endpoint Manager functionality followed by POST requests containing fwbrand, path traversal sequences, encoded traversal characters, absolute paths, or uploaded PHP-like content. Review Apache or Nginx logs for successful requests to newly created PHP files under FreePBX web paths after an upload event. On the host, search web roots and FreePBX module directories for recently modified files, especially PHP files with webshell-like functions such as system, shell_exec, passthru, exec, base64_decode, eval, assert, preg_replace with /e, or file_put_contents. Examine process telemetry for the web server user spawning shells, interpreters, networking utilities, or PBX administration commands unexpectedly. Review FreePBX administrative logs for unusual Endpoint Manager changes, new users, role changes, module modifications, or provisioning template changes. Because exploitation requires authentication, also review successful logins from unusual IP addresses, impossible travel, password-spray precursors, or use of dormant accounts. If threat intelligence identifies exploitation campaigns in the future, enrich hunts with those actor-specific infrastructure indicators; none are provided in the input.

• fwbrand=../
• fwbrand=..%2f
• fwbrand=%2e%2e%2f
• fwbrand=..%252f
• fwbrand=/var/www/html
• fwbrand=/var/www/html/admin
• fwbrand=C%3A%5C
• POST /admin/ajax.php
• module=endpointman
• /admin/modules/endpointman/
• /var/www/html/admin/modules/endpointman/
• /var/www/html/admin/
• <?php
• shell_exec(
• passthru(
• base64_decode(
• eval(
• system(
• assert(
• cmd=
• GET /admin/modules/endpointman/
• POST /admin/modules/endpointman/
• www-data /bin/sh
• apache /bin/sh
• httpd /bin/sh
• asterisk /bin/sh

What your security team should do

• Patch FreePBX Endpoint Manager immediately to 16.0.92 or later for FreePBX 16 and 17.0.6 or later for FreePBX 17, prioritizing internet-facing or externally reachable administration interfaces.
• Restrict FreePBX administrative access to trusted networks, VPN, or bastion hosts; remove direct internet exposure wherever possible.
• Audit FreePBX users and roles, focusing on accounts with Endpoint Manager or administrative privileges, and reset credentials for suspicious or stale accounts.
• Hunt for arbitrary file upload and webshell activity in FreePBX web directories, especially recently created PHP files and requests containing fwbrand with traversal or encoded path characters.
• Review web server access logs, FreePBX administrative logs, authentication logs, and endpoint management activity for suspicious authenticated sessions.
• Disable Endpoint Manager temporarily if patching cannot be completed quickly.
• Add detection rules for POST requests to FreePBX admin endpoints that include fwbrand values with path traversal, encoded traversal, absolute paths, or PHP upload indicators.
• Validate vulnerability management data because the supplied affected-product entries reference LibreOffice packages and may represent inaccurate product mapping for this FreePBX issue.