FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE

FreePBX has been patched after Horizon3[.]ai disclosed multiple critical flaws that could allow remote code execution, including an authentication bypass when AUTHTYPE is set to webserver. The vulnerabilities span an authenticated SQL injection (CVE-2025-61675), an authenticated file upload flaw (CVE-2025-61678), and a high‑risk authentication bypass (CVE-2025-66039) with CVSS scores up to 9.3, affecting four endpoints and 11 parameters in the first case, and enabling a PHP web shell upload in the second.

According to Horizon3[.]ai security researcher Noah King, these flaws are easily exploitable and can enable remote code execution on vulnerable FreePBX instances; patches were issued, with CVE-2025-61675 and CVE-2025-61678 fixed in versions 16.0.92 and 17.0.6 on 14 October 2025, and CVE-2025-66039 fixed in 16.0.44 and 17.0.23 on 9 December 2025.

FreePBX has also removed the option to choose an authentication provider from Advanced Settings, requiring manual configuration via fwconsole, and temporary mitigations include setting "Authorization Type" to "usermanager" and rebooting to disconnect rogue sessions. The company warns that, even when not in default configurations, an attacker could still exploit crafted requests to insert a malicious user or execute code, underscoring the need for updating and following the new configuration steps.