{"vulnerability": "CVE-2025-6167", "sightings": [{"uuid": "5edc9662-c291-4a71-995c-01e9f0eb6871", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61673", "type": "seen", "source": "https://bsky.app/profile/test001-05.bsky.social/post/3m2dx66sbgh2a", "content": "", "creation_timestamp": "2025-10-04T06:25:20.963884Z"}, {"uuid": "0d50a8a8-62aa-496b-a65b-455b8e4196ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61673", "type": "seen", "source": "https://bsky.app/profile/test001-05.bsky.social/post/3m2dy3wvyuu2i", "content": "", "creation_timestamp": "2025-10-04T06:42:00.041668Z"}, {"uuid": "52b6a1ad-3e2a-4935-98fb-ba466f713214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-61679", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m2e2z2wcyk2s", "content": "", "creation_timestamp": "2025-10-04T07:34:04.207493Z"}, {"uuid": "ac4ec833-1c35-4435-b5d2-bdb26ab7b087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-61673", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m2e7z7bwp72a", "content": "", "creation_timestamp": "2025-10-04T09:03:38.434842Z"}, {"uuid": "cb1b627d-1248-4ae8-8398-f77b283df2c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61677", "type": "seen", "source": "http://www.zerodayinitiative.com/advisories/ZDI-25-965/", "content": "", "creation_timestamp": "2025-10-27T04:00:00.000000Z"}, {"uuid": "f2fd3839-4274-4106-af1e-8643f67d3b57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_firmware_file_upload.rb", "content": "", "creation_timestamp": "2026-01-28T14:53:46.000000Z"}, {"uuid": "eb76b867-b274-4740-babd-d6d0810923f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/freepbx_custom_extension_injection.rb", "content": "", "creation_timestamp": "2026-01-28T14:53:46.000000Z"}, {"uuid": "5a1cffc0-79d8-450c-859f-7c4ba2b57059", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_custom_extension_rce.rb", "content": "", "creation_timestamp": "2026-01-29T04:14:36.000000Z"}, {"uuid": "a84a22e3-6307-4fbc-9e3f-96fc4501fa4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mdloqbpio42h", "content": "", "creation_timestamp": "2026-01-29T21:02:31.150283Z"}, {"uuid": "68c198c6-f6f2-4f66-b9a5-ba4ba9854945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mdloqbsakz2k", "content": "", "creation_timestamp": "2026-01-29T21:02:31.668137Z"}, {"uuid": "56b0d439-fc10-42ee-9458-42aabd64569d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c2287cd6-d267563f616a1862", "content": "", "creation_timestamp": "2025-12-15T15:57:55.363277Z"}, {"uuid": "1f7ce20a-5723-45d6-bdbc-4ac452f24f4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c2287cd6-d267563f616a1862", "content": "", "creation_timestamp": "2025-12-15T15:57:55.456790Z"}, {"uuid": "bd931f2b-eb3a-425e-98c1-c09a43e85511", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://gist.github.com/Darkcrai86/99ebe103893e94f149e5de4d298501ec", "content": "", "creation_timestamp": "2025-12-15T16:21:07.000000Z"}, {"uuid": "924ebe26-4de4-4bfe-bb93-a40644e18345", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://thehackernews.com/2025/12/freepbx-authentication-bypass-exposed.html", "content": "", "creation_timestamp": "2025-12-15T13:32:00.000000Z"}, {"uuid": "ad19f15c-d1ed-4e41-8a6f-3c670c65dcb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61674", "type": "seen", "source": "https://gist.github.com/alon710/b274d24af14fa6b3d017a948e89a5c9f", "content": "", "creation_timestamp": "2026-01-24T21:26:02.000000Z"}, {"uuid": "fa4d0bff-43a4-4252-a18e-d422fea7777e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61676", "type": "seen", "source": "https://gist.github.com/alon710/cab39bb7b7e9c041bbe78dfe671c1cec", "content": "", "creation_timestamp": "2026-01-24T21:26:19.000000Z"}, {"uuid": "a4b09580-516b-41be-a850-11166666c7ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61676", "type": "seen", "source": "https://gist.github.com/alon710/cdd55c5ef1010eed6c30711e4e14b80a", "content": "", "creation_timestamp": "2026-01-24T22:41:41.000000Z"}, {"uuid": "f11185eb-7209-4960-9911-44309bc108ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61674", "type": "seen", "source": "https://gist.github.com/alon710/1f9c5c1b631ce1df5935de9396e1f1ed", "content": "", "creation_timestamp": "2026-01-24T22:41:25.000000Z"}, {"uuid": "271e4f55-c5dd-453d-ae66-fa5bbef89e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "published-proof-of-concept", "source": "Telegram/yKrXr4JQE_-pnW9EQgEW99SqPSf-_Tkr6yktWy5rEdX4cGs", "content": "", "creation_timestamp": "2026-01-04T03:00:05.000000Z"}, {"uuid": "0b872a39-0dd4-4d3c-b2f7-a2e3eb5b0e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "published-proof-of-concept", "source": "Telegram/yKrXr4JQE_-pnW9EQgEW99SqPSf-_Tkr6yktWy5rEdX4cGs", "content": "", "creation_timestamp": "2026-01-04T03:00:05.000000Z"}, {"uuid": "326f692b-7aba-460a-8c96-88636ecff37a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "published-proof-of-concept", "source": "Telegram/eipyR0KgNonT7wOL7ZKwmO8kNPLXykuyv2avaPuoPm3xW80", "content": "", "creation_timestamp": "2025-12-16T09:00:04.000000Z"}, {"uuid": "0458d4b8-9fed-415e-99de-4257ec6b7a36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "published-proof-of-concept", "source": "Telegram/eipyR0KgNonT7wOL7ZKwmO8kNPLXykuyv2avaPuoPm3xW80", "content": "", "creation_timestamp": "2025-12-16T09:00:04.000000Z"}, {"uuid": "f47b3e89-6b08-4628-97e2-f8f934ffbf02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "published-proof-of-concept", "source": "Telegram/OHr82OtRsE7SrX-5JX0BTKOCwGseELWPcAGkyhObfyZN6dU", "content": "", "creation_timestamp": "2025-12-14T15:00:08.000000Z"}, {"uuid": "9f8407cb-0bfa-4b19-88fa-27065d3cbc59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "published-proof-of-concept", "source": "Telegram/OHr82OtRsE7SrX-5JX0BTKOCwGseELWPcAGkyhObfyZN6dU", "content": "", "creation_timestamp": "2025-12-14T15:00:08.000000Z"}, {"uuid": "24b6a464-0e8e-4c1c-ae1d-78b324bf3f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61676", "type": "published-proof-of-concept", "source": "Telegram/UDMk206lgQvLt4zm60yBzpmxh6GeqSRvdRaLpn90JAOiIEo", "content": "", "creation_timestamp": "2026-01-10T05:02:58.000000Z"}, {"uuid": "9d7bd169-bfb7-44fc-bf5b-a85111b9b8ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61674", "type": "published-proof-of-concept", "source": "Telegram/UDMk206lgQvLt4zm60yBzpmxh6GeqSRvdRaLpn90JAOiIEo", "content": "", "creation_timestamp": "2026-01-10T05:02:58.000000Z"}, {"uuid": "1dbecf4a-4bdc-4461-9df0-f23d8f364e89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6167", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/18571", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6167\n\ud83d\udd25 CVSS Score: 5.1 (cvssV4_0, Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X)\n\ud83d\udd39 Description: A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.\n\ud83d\udccf Published: 2025-06-17T06:31:05.717Z\n\ud83d\udccf Modified: 2025-06-17T06:31:05.717Z\n\ud83d\udd17 References:\n1. https://vuldb.com/?id.312642\n2. https://vuldb.com/?ctiid.312642\n3. https://vuldb.com/?submit.593613\n4. https://github.com/themanojdesai/python-a2a/issues/40\n5. https://github.com/themanojdesai/python-a2a/issues/40#issuecomment-2904804388\n6. https://github.com/themanojdesai/python-a2a/releases/tag/v0.5.6", "creation_timestamp": "2025-06-17T07:36:45.000000Z"}, {"uuid": "bd707ba6-532e-42a6-9922-42e9e40da5dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "published-proof-of-concept", "source": "Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY", "content": "", "creation_timestamp": "2026-06-12T21:00:04.000000Z"}, {"uuid": "b330f885-a428-45c5-81c6-91f32095e948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61670", "type": "seen", "source": "https://gist.github.com/alon710/553eb2089447345d30a93b1881dc2ee5", "content": "# CVE-2025-61670: CVE-2025-61670: Memory Leak in Wasmtime C/C++ API WebAssembly GC Reference Handling\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2025-61670\n\n## Summary\nA technical analysis of CVE-2025-61670, a memory leak vulnerability in Wasmtime's C and C++ API bindings. The issue stems from a refactoring in version 37.0.0 that transitioned garbage-collected reference tracking to host heap-allocated OwnedRooted types without updating FFI ownership semantics.\n\n## TL;DR\nA memory leak in Wasmtime v37.0.0-37.0.1 C/C++ bindings allows local guest modules to exhaust host memory and cause a denial of service.\n\n## Technical Details\n\n- **CWE ID**: CWE-772\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1**: 3.3 (Low)\n- **EPSS Score**: 0.00178 (0.18% probability)\n- **Impact**: Availability (Memory Exhaustion / DoS)\n- **Exploit Status**: No public PoC\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Wasmtime C and C++ API bindings\n- Downstream bindings utilizing C APIs (e.g. wasmtime-py)\n- **Wasmtime**: >= 37.0.0, <= 37.0.1 (Fixed in: `37.0.2`)\n\n## Mitigation\n\n- Upgrade Wasmtime to version 37.0.2 or higher.\n- Avoid using GC-managed values (anyref, externref) over C/C++ boundaries, substituting primitive index handles instead.\n\n**Remediation Steps:**\n1. Update build dependencies (e.g., Cargo, CMake) to pull Wasmtime v37.0.2 or later.\n2. Recompile the C/C++ host application using the updated headers to inherit the corrected RAII destructors.\n3. Run runtime tests using AddressSanitizer or Valgrind to verify that GC reference lifecycles are correctly reclaimed upon scope exit.\n\n## References\n\n- [Bytecode Alliance Security Advisory GHSA-vvp9-h8p2-xwfc](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vvp9-h8p2-xwfc)\n- [Wasmtime Fix Commit adff9d9d0f09569203709d5687e5a7dc8e1ad0a3](https://github.com/bytecodealliance/wasmtime/commit/adff9d9d0f09569203709d5687e5a7dc8e1ad0a3)\n- [Wasmtime Release v37.0.2](https://github.com/bytecodealliance/wasmtime/releases/tag/v37.0.2)\n- [NVD CVE-2025-61670](https://nvd.nist.gov/vuln/detail/CVE-2025-61670)\n- [CVE.org CVE-2025-61670](https://www.cve.org/CVERecord?id=CVE-2025-61670)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-61670) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T19:42:05.146724Z"}, {"uuid": "048d515e-6640-40f5-89e7-a242fecf5f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/freepbx_custom_extension_injection.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"FreePBX versions prior to 16.0.44,16.0.92 and 17.0.23,17.0.6 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new administrative user.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"auxiliary/gather/freepbx_custom_extension_injection\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 11:14:24 +0000\", \"name\": \"FreePBX Custom Extension SQL Injection\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/freepbx_custom_extension_injection.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/freepbx_custom_extension_injection\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61675\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:14.448976Z"}, {"uuid": "7234f20f-96d0-4ec3-b048-6d498f7e2f65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_custom_extension_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"FreePBX is an open-source IP PBX management tool that provides a modern phone system for businesses that use\\n          VoIP to make and receive phone calls. Versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039,\\n          while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an\\n          authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it\\n          allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module\\n          exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an\\n          unauthenticated SQL injection attack and gains remote code execution by injecting an SQL record into th\\n          cron_jobs table. The cron_jobs database contains cron tasks that FreePBX executes in the context of the\\n          operating system.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"exploit/unix/http/freepbx_custom_extension_rce\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 20:15:25 +0000\", \"name\": \"FreePBX endpoint SQLi to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/freepbx_custom_extension_rce.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/http/freepbx_custom_extension_rce\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61675\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:35.939500Z"}, {"uuid": "8d5190e5-110c-4651-9ca3-4a623e0012ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61678", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/freepbx_firmware_file_upload.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Noah King\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61678. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter allows unrestricted file uploads via firmware upload, including path traversal. These vulnerabilities allow unauthenticated remote code execution by bypassing authentication and placing a webshell in the web server's directory.\", \"disclosure_date\": \"2025-12-11\", \"fullname\": \"exploit/unix/http/freepbx_firmware_file_upload\", \"is_install_path\": true, \"mod_time\": \"2026-01-28 06:08:47 +0000\", \"name\": \"FreePBX firmware file upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/http/freepbx_firmware_file_upload.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"unix/http/freepbx_firmware_file_upload\", \"references\": [\"CVE-2025-66039\", \"CVE-2025-61678\", \"URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:36.194168Z"}]}