H00DIE-GR3YGitHub ↗ (opens in a new tab)
Menu
ORIGINAL RESEARCHCVE-2026-26978

CVE-2026-26978 — FreePBX Backup & Restore PHP Object Injection to RCE

Authenticated PHP object injection in the FreePBX Backup & Restore module. Attacker-controlled manifest data reaches unserialize() during restore and can be weaponized for remote code execution.

Originally published on Rapid7 AttackerKB · 2026-05-24 · revised 2026-06-03

Overview

An authenticated remote code execution vulnerability affects the FreePBX Backup & Restore module. During a restore operation, attacker-controlled data from a supplied backup archive can reach PHP’s unserialize() function without validation, class restrictions, or integrity checks.

A low-privileged authenticated user with backup or restore permissions can upload a crafted archive containing a malicious manifest file and achieve arbitrary command execution on the FreePBX server.

Attack prerequisites

Successful exploitation requires:

  • a valid authenticated FreePBX account;
  • the Backup & Restore module to be enabled; and
  • either Backup & Restore permission or Restore-only permission.

The original research notes that the restore-only role appears partially broken, but still permits exploitation.

Technical analysis

The restore workflow trusts metadata extracted from an attacker-supplied backup archive. The critical sink is reached when the extracted manifest is deserialized.

Root cause

During backup restoration, FreePBX extracts selected files from a user-supplied archive. If a manifest file exists, its contents are read and passed directly to unserialize():

if (file_exists($manafestfile)) {
    $manifestdata = file_get_contents($manafestfile);
    $tmpdata = unserialize($manifestdata);
    $meta = [
        'manifest' => $tmpdata
    ];
}

Because the archive contents are attacker-controlled, this creates a PHP Object Injection condition. A suitable gadget chain can then be used to execute arbitrary code. The research validated exploitation with monolog/rce7; other available gadget chains may also be viable.

Proof of concept

1. Generate a malicious manifest

The research used phpggc with a Monolog gadget chain:

phpggc monolog/rce7 exec "touch /var/www/html/pawned" -o manifest

2. Create the backup archive

tar -cvzf evil_backup.tar manifest

Additional backup files may be required where validation checks apply.

3. Upload and restore

  1. Sign in to the FreePBX administration interface.
  2. Navigate to Admin → Backup & Restore.
  3. Upload the crafted backup archive.
  4. Restore the backup.

When the malicious manifest reaches the unsafe deserialization sink, the gadget chain is executed.

4. Validate execution

The proof of concept creates /var/www/html/pawned, confirming arbitrary command execution during the restore workflow.

Impact

Successful exploitation results in remote code execution in the context of the FreePBX web server process. The upstream vulnerability description notes that this is typically the asterisk or www-data account. The attack does not require shell or CLI access beyond the normal authenticated restore workflow.

Remediation

  • FreePBX 16 Backup & Restore: versions below 16.0.71 are affected. Upgrade to 16.0.71 or later.
  • FreePBX 17 Backup & Restore: versions >= 17.0.0 and < 17.0.6 are affected. Upgrade to 17.0.6 or later.

References

Credits

Discovery: h00die-gr3y.