CVE-2025-59056

Severity CVSS v4.0:

MEDIUM

Type:

CWE-22 Path Traversal

Publication date:

15/09/2025

Last modified:

16/09/2025

Description

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module&#39;s database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:L/U:Red CVSS v4.0 Severity and Metrics:

Base Score: 6.60 MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:L/U:Red

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): None
User Interaction (UI): None
Confidentiality (VC): None
Integrity (VI): None
Availability (VA): High
Confidentiality (SC): None
Integrity (SI): None
Availability (SA): None
Automatable (AU): Yes
Recovery (R): User
Value Density (V): Diffuse
Vulnerability Response Effort (RE): Low
Provider Urgency (U): Red
Exploit Maturity (E): Unreported

Base Score 4.0

6.60

Severity 4.0

MEDIUM

CVE-2025-59056

Description

Impact

References to Advisories, Solutions, and Tools