github.com
https://github.com/FreePBX/framework/blame/release/17.0/amp_conf/htdocs/admin/ajax.php CVE-2025-59056
MEDIUM
FreePBX vulnerable to unauthenticated Denial of Service
Record summary
CVE-2025-59056 has a selected CVSS score of 6.6 (medium).
Description
FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 16, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
frameworkBrowse FreePBX / framework | CVE List | < 15.0.38 | affected |
| >= 16.0.0, < 16.0.41 | affected | ||
| >= 17.0.0, < 17.0.21 | affected |
References
2github.comConfirmation
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-frc2-jhgg-rwpr