CVE-2026-26978

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-26978

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26978.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-26978

Aliases

GHSA-5v7h-49gr-jcwr

Published

2026-05-18T20:49:04.364Z

Modified

2026-07-15T01:49:11.445523144Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php

Details

FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26978.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/freepbx/backup

Affected ranges

Type

GIT

Repo

https://github.com/freepbx/backup

Events

Introduced

Fixed

376f02c99cb9bb197bd74d63c18e4a356a82928d

Fixed

f6b87ecac434bf33317f1a21e3cf73541b0207c5

Fixed

45c57e1207cbf9fd1c5f76f8a3e72d204a69a472

Fixed

64781af5c80cce0cff21a981be4d8e6a7a71f2c4

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.0.71"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.0.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release/1.*

release/1.2

release/12.*

release/12.0.0

release/12.0.1

release/12.0.2

release/12.0.3

release/12.0.4

release/12.0.5

release/12.0.7

release/12.0.8

release/12.0.9

release/13.*

release/13.0.10

release/13.0.11

release/13.0.12

release/13.0.13

release/13.0.14

release/13.0.16

release/13.0.17

release/13.0.18

release/13.0.18.1

release/13.0.18.2

release/13.0.19

release/13.0.19.1

release/13.0.1alpha1

release/13.0.1alpha2

release/13.0.1alpha3

release/13.0.1alpha4

release/13.0.1alpha5

release/13.0.2

release/13.0.20

release/13.0.21

release/13.0.21.1

release/13.0.21.2

release/13.0.21.3

release/13.0.21.4

release/13.0.21.5

release/13.0.21.6

release/13.0.21.7

release/13.0.21.8

release/13.0.21.9

release/13.0.22

release/13.0.23

release/13.0.24

release/13.0.25

release/13.0.25.1

release/13.0.25.2

release/13.0.25.3

release/13.0.25.4

release/13.0.25.5

release/13.0.25.6

release/13.0.26

release/13.0.26.1

release/13.0.26.2

release/13.0.26.3

release/13.0.26.4

release/13.0.26.5

release/13.0.26.6

release/13.0.26.7

release/13.0.26.8

release/13.0.27

release/13.0.27.1

release/13.0.27.2

release/13.0.27.3

release/13.0.3

release/13.0.4

release/13.0.5

release/13.0.6

release/13.0.7

release/13.0.9

release/15.*

release/15.0.1

release/15.0.3alpha1

release/15.0.3alpha10

release/15.0.3alpha11

release/15.0.3alpha12

release/15.0.3alpha14

release/15.0.3alpha15

release/15.0.3alpha2

release/15.0.3alpha3

release/15.0.3alpha4

release/15.0.3alpha5

release/15.0.3alpha9

release/15.0.3beta1

release/15.0.3beta4

release/15.0.3beta5

release/15.0.3beta7

release/15.0.4

release/15.0.4.1

release/15.0.4.2

release/15.0.4.3

release/15.0.4.4

release/15.0.4.5

release/15.0.4.6

release/15.0.4.7

release/15.0.5

release/15.0.5.1

release/15.0.5.2

release/15.0.5.3

release/15.0.5.4

release/15.0.6

release/15.0.7

release/15.0.8

release/15.0.8.1

release/15.0.8.10

release/15.0.8.11

release/15.0.8.12

release/15.0.8.13

release/15.0.8.14

release/15.0.8.15

release/15.0.8.16

release/15.0.8.17

release/15.0.8.19

release/15.0.8.2

release/15.0.8.20

release/15.0.8.21

release/15.0.8.22

release/15.0.8.23

release/15.0.8.24

release/15.0.8.25

release/15.0.8.26

release/15.0.8.27

release/15.0.8.28

release/15.0.8.29

release/15.0.8.30

release/15.0.8.31

release/15.0.8.32

release/15.0.8.33

release/15.0.8.34

release/15.0.8.35

release/15.0.8.36

release/15.0.8.37

release/15.0.8.38

release/15.0.8.39

release/15.0.8.40

release/15.0.8.41

release/15.0.8.42

release/15.0.8.43

release/15.0.8.44

release/15.0.8.45

release/15.0.8.46

release/15.0.8.47

release/15.0.8.48

release/15.0.8.49

release/15.0.8.5

release/15.0.8.50

release/15.0.8.51

release/15.0.8.52

release/15.0.8.53

release/15.0.8.54

release/15.0.8.55

release/15.0.8.56

release/15.0.8.57

release/15.0.8.58

release/15.0.8.59

release/15.0.8.6

release/15.0.8.60

release/15.0.8.61

release/15.0.8.62

release/15.0.8.63

release/15.0.8.64

release/15.0.8.65

release/15.0.8.66

release/15.0.8.67

release/15.0.8.68

release/15.0.8.69

release/15.0.8.7

release/15.0.8.70

release/15.0.8.71

release/15.0.8.72

release/15.0.8.73

release/15.0.8.77

release/15.0.8.78

release/15.0.8.79

release/15.0.8.8

release/15.0.8.80

release/15.0.8.81

release/15.0.8.82

release/15.0.8.83

release/15.0.8.84

release/15.0.8.85

release/15.0.8.86

release/15.0.8.9

release/16.*

release/16.0.10

release/16.0.11

release/16.0.12

release/16.0.13

release/16.0.14

release/16.0.15

release/16.0.16

release/16.0.17

release/16.0.18

release/16.0.19

release/16.0.2

release/16.0.20

release/16.0.21

release/16.0.22

release/16.0.23

release/16.0.24

release/16.0.25

release/16.0.26

release/16.0.27

release/16.0.28

release/16.0.29

release/16.0.3

release/16.0.30

release/16.0.31

release/16.0.32

release/16.0.33

release/16.0.34

release/16.0.35

release/16.0.36

release/16.0.37

release/16.0.38

release/16.0.39

release/16.0.4

release/16.0.40

release/16.0.41

release/16.0.42

release/16.0.43

release/16.0.44

release/16.0.45

release/16.0.46

release/16.0.47

release/16.0.48

release/16.0.49

release/16.0.5

release/16.0.50

release/16.0.50.1

release/16.0.50.10

release/16.0.50.11

release/16.0.50.12

release/16.0.50.13

release/16.0.50.2

release/16.0.50.3

release/16.0.50.4

release/16.0.50.5

release/16.0.50.6

release/16.0.50.7

release/16.0.50.8

release/16.0.50.9

release/16.0.51

release/16.0.52

release/16.0.53

release/16.0.54

release/16.0.55

release/16.0.56

release/16.0.57

release/16.0.58

release/16.0.59

release/16.0.6

release/16.0.60

release/16.0.61

release/16.0.62

release/16.0.62.1

release/16.0.62.10

release/16.0.62.11

release/16.0.62.12

release/16.0.62.2

release/16.0.62.3

release/16.0.62.4

release/16.0.62.5

release/16.0.62.6

release/16.0.62.7

release/16.0.62.8

release/16.0.62.9

release/16.0.63

release/16.0.64

release/16.0.65

release/16.0.66

release/16.0.67

release/16.0.68

release/16.0.69

release/16.0.7

release/16.0.70

release/16.0.70.1

release/16.0.70.2

release/16.0.70.3

release/16.0.70.4

release/16.0.70.5

release/16.0.8

release/16.0.9

release/17.*

release/17.0.1

release/17.0.2

release/17.0.3

release/17.0.4

release/17.0.5

release/17.0.5.1

release/17.0.5.10

release/17.0.5.11

release/17.0.5.12

release/17.0.5.13

release/17.0.5.14

release/17.0.5.15

release/17.0.5.16

release/17.0.5.17

release/17.0.5.18

release/17.0.5.19

release/17.0.5.2

release/17.0.5.20

release/17.0.5.21

release/17.0.5.22

release/17.0.5.23

release/17.0.5.24

release/17.0.5.25

release/17.0.5.26

release/17.0.5.27

release/17.0.5.28

release/17.0.5.29

release/17.0.5.3

release/17.0.5.30

release/17.0.5.31

release/17.0.5.32

release/17.0.5.33

release/17.0.5.34

release/17.0.5.35

release/17.0.5.36

release/17.0.5.37

release/17.0.5.38

release/17.0.5.39

release/17.0.5.4

release/17.0.5.40

release/17.0.5.41

release/17.0.5.42

release/17.0.5.43

release/17.0.5.44

release/17.0.5.45

release/17.0.5.46

release/17.0.5.47

release/17.0.5.48

release/17.0.5.49

release/17.0.5.5

release/17.0.5.50

release/17.0.5.51

release/17.0.5.52

release/17.0.5.53

release/17.0.5.54

release/17.0.5.55

release/17.0.5.56

release/17.0.5.57

release/17.0.5.58

release/17.0.5.59

release/17.0.5.6

release/17.0.5.60

release/17.0.5.61

release/17.0.5.62

release/17.0.5.63

release/17.0.5.64

release/17.0.5.65

release/17.0.5.66

release/17.0.5.67

release/17.0.5.68

release/17.0.5.69

release/17.0.5.7

release/17.0.5.70

release/17.0.5.71

release/17.0.5.8

release/17.0.5.9

release/2.*

release/2.0

release/2.0.1

release/2.0.2

release/2.0.3

release/2.1

release/2.1.1

release/2.1.2

release/2.1.3

release/2.1.4

release/2.1.4.1

release/2.1.4.2

release/2.1.4.3

release/2.1.4.4

release/2.1.4.5

release/2.1.4.6

release/2.1.4.7

release/2.1.4.8

release/2.11.0.11

release/2.11.0.12

release/2.11.0.13

release/2.11.0.14

release/2.11.0.15

release/2.11.0.16

release/2.11.0.17

release/2.11.0.20

release/2.11.0.6

release/2.11.0.7

release/2.11.0.8

release/2.4.0

release/2.4.1

release/2.4.1.1

release/2.5.0

release/2.5.0.1

release/2.5.0.2

release/2.5.1

release/2.5.1.1

release/2.5.1.2

release/2.5.1.3

release/2.5.1.4

release/2.5.1.5

release/2.6.0.0

release/2.6.0.1

release/2.6.0.2

release/2.6.0.3

release/2.6.0.4

release/2.7.0.1beta1.1

release/2.7.0.1beta1.2

release/2.7.0.2

release/2.7.0.3

release/2.7.0.4

release/2.7.0.5

release/2.7.0beta1.0

release/2.8.0.0

release/2.8.0.1

release/2.8.0.2

release/2.8.0.3

release/2.8.0.4

release/2.8.0.5

release/2.8.0.6

release/2.9.0.0

release/2.9.0.1

release/2.9.0.2

release/2.9.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26978.json"