{"id":"CVE-2026-26978","summary":"Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php","details":"FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6.","aliases":["GHSA-5v7h-49gr-jcwr"],"modified":"2026-07-15T01:49:11.445523144Z","published":"2026-05-18T20:49:04.364Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26978.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26978.json"},{"type":"ADVISORY","url":"https://github.com/FreePBX/security-reporting/security/advisories/GHSA-5v7h-49gr-jcwr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26978"},{"type":"FIX","url":"https://github.com/FreePBX/backup/commit/45c57e1207cbf9fd1c5f76f8a3e72d204a69a472"},{"type":"FIX","url":"https://github.com/FreePBX/backup/commit/64781af5c80cce0cff21a981be4d8e6a7a71f2c4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freepbx/backup","events":[{"introduced":"0"},{"fixed":"376f02c99cb9bb197bd74d63c18e4a356a82928d"},{"fixed":"f6b87ecac434bf33317f1a21e3cf73541b0207c5"},{"fixed":"45c57e1207cbf9fd1c5f76f8a3e72d204a69a472"},{"fixed":"64781af5c80cce0cff21a981be4d8e6a7a71f2c4"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"16.0.71"},{"introduced":"17.0.0"},{"fixed":"17.0.6"}]}}],"versions":["release/17.0.5.71","release/16.0.70.5","release/17.0.5.70","release/17.0.5.69","release/17.0.5.68","release/16.0.70.4","release/17.0.5.67","release/17.0.5.66","release/17.0.5.65","release/17.0.5.64","release/16.0.70.3","release/17.0.5.63","release/17.0.5.62","release/17.0.5.61","release/17.0.5.60","release/16.0.70.2","release/17.0.5.59","release/16.0.70.1","release/17.0.5.58","release/16.0.70","release/17.0.5.57","release/17.0.5.56","release/17.0.5.55","release/17.0.5.54","release/17.0.5.53","release/17.0.5.52","release/17.0.5.51","release/17.0.5.50","release/17.0.5.49","release/17.0.5.48","release/17.0.5.47","release/17.0.5.46","release/17.0.5.45","release/17.0.5.44","release/17.0.5.43","release/17.0.5.42","release/17.0.5.41","release/17.0.5.40","release/17.0.5.39","release/17.0.5.38","release/17.0.5.37","release/17.0.5.36","release/17.0.5.35","release/17.0.5.34","release/17.0.5.33","release/17.0.5.32","release/17.0.5.31","release/17.0.5.30","release/17.0.5.29","release/17.0.5.28","release/17.0.5.27","release/17.0.5.26","release/17.0.5.25","release/17.0.5.24","release/17.0.5.23","release/17.0.5.22","release/17.0.5.21","release/17.0.5.20","release/17.0.5.19","release/17.0.5.18","release/17.0.5.17","release/17.0.5.16","release/17.0.5.15","release/17.0.5.14","release/17.0.5.11","release/17.0.5.13","release/17.0.5.12","release/16.0.69","release/17.0.5.10","release/16.0.68","release/17.0.5.9","release/17.0.5.8","release/16.0.67","release/17.0.5.7","release/17.0.5.6","release/17.0.5.5","release/17.0.5.4","release/17.0.5.3","release/17.0.5.2","release/17.0.5.1","release/17.0.5","release/17.0.4","release/17.0.3","release/17.0.2","release/17.0.1","release/16.0.66","release/16.0.65","release/16.0.64","release/16.0.63","release/16.0.62.12","release/16.0.62.11","release/16.0.62.10","release/16.0.62.9","release/16.0.62.8","release/16.0.62.7","release/16.0.62.6","release/16.0.62.5","release/16.0.62.4","release/16.0.62.3","release/16.0.62.2","release/16.0.62.1","release/16.0.62","release/16.0.61","release/16.0.60","release/16.0.59","release/16.0.58","release/16.0.57","release/16.0.56","release/16.0.55","release/16.0.54","release/16.0.53","release/16.0.52","release/16.0.51","release/16.0.50.13","release/16.0.50.12","release/16.0.50.11","release/16.0.50.10","release/16.0.50.9","release/16.0.50.8","release/16.0.50.7","release/16.0.50.6","release/16.0.50.5","release/16.0.50.4","release/16.0.50.3","release/16.0.50.2","release/16.0.50.1","release/16.0.50","release/16.0.49","release/16.0.48","release/16.0.47","release/16.0.46","release/16.0.45","release/16.0.44","release/16.0.43","release/16.0.42","release/16.0.41","release/16.0.40","release/16.0.39","release/16.0.38","release/16.0.37","release/16.0.36","release/16.0.35","release/16.0.34","release/16.0.33","release/16.0.32","release/16.0.31","release/16.0.30","release/16.0.29","release/16.0.28","release/16.0.27","release/16.0.26","release/16.0.25","release/16.0.24","release/16.0.23","release/16.0.22","release/16.0.21","release/16.0.20","release/16.0.19","release/16.0.18","release/16.0.17","release/16.0.16","release/16.0.15","release/16.0.14","release/16.0.13","release/16.0.12","release/16.0.11","release/16.0.10","release/16.0.9","release/16.0.8","release/16.0.7","release/16.0.6","release/16.0.5","release/16.0.4","release/16.0.3","release/16.0.2","release/15.0.8.86","release/15.0.8.85","release/15.0.8.84","release/15.0.8.83","release/15.0.8.82","release/15.0.8.81","release/15.0.8.80","release/15.0.8.79","release/15.0.8.77","release/15.0.8.78","release/15.0.8.73","release/15.0.8.72","release/15.0.8.71","release/15.0.8.70","release/15.0.8.69","release/15.0.8.68","release/15.0.8.66","release/15.0.8.67","release/15.0.8.65","release/15.0.8.64","release/15.0.8.63","release/15.0.8.62","release/15.0.8.61","release/15.0.8.60","release/15.0.8.59","release/15.0.8.58","release/15.0.8.57","release/15.0.8.55","release/15.0.8.56","release/15.0.8.54","release/15.0.8.53","release/15.0.8.52","release/15.0.8.51","release/15.0.8.50","release/15.0.8.49","release/15.0.8.48","release/15.0.8.47","release/15.0.8.46","release/15.0.8.45","release/15.0.8.44","release/15.0.8.43","release/15.0.8.42","release/15.0.8.41","release/15.0.8.40","release/15.0.8.39","release/15.0.8.38","release/15.0.8.37","release/15.0.8.36","release/15.0.8.35","release/15.0.8.34","release/15.0.8.33","release/15.0.8.32","release/15.0.8.30","release/15.0.8.31","release/15.0.8.29","release/15.0.8.28","release/15.0.8.27","release/15.0.8.26","release/15.0.8.25","release/15.0.8.24","release/15.0.8.23","release/15.0.8.22","release/15.0.8.17","release/15.0.8.21","release/15.0.8.20","release/15.0.8.19","release/15.0.8.16","release/15.0.8.15","release/15.0.8.14","release/15.0.8.13","release/15.0.8.12","release/15.0.8.11","release/15.0.8.10","release/15.0.8.9","release/15.0.8.8","release/15.0.8.7","release/15.0.8.6","release/15.0.8.5","release/15.0.8.2","release/15.0.8.1","release/15.0.8","release/15.0.7","release/15.0.6","release/15.0.5.4","release/15.0.5.3","release/15.0.5.2","release/15.0.5.1","release/15.0.5","release/15.0.4.7","release/15.0.4.6","release/15.0.4.5","release/15.0.4.4","release/15.0.4.3","release/15.0.4.2","release/15.0.4.1","release/15.0.4","release/15.0.3beta7","release/15.0.3beta4","release/15.0.3beta5","release/15.0.3beta1","release/15.0.3alpha15","release/15.0.3alpha14","release/15.0.3alpha12","release/15.0.3alpha11","release/15.0.3alpha10","release/15.0.3alpha9","release/15.0.3alpha4","release/15.0.3alpha5","release/15.0.3alpha3","release/15.0.3alpha2","release/15.0.3alpha1","release/15.0.1","release/13.0.27.3","release/13.0.27.2","release/13.0.27.1","release/13.0.27","release/13.0.26.8","release/13.0.26.7","release/13.0.26.6","release/13.0.26.5","release/13.0.26.4","release/13.0.26.3","release/13.0.26.2","release/13.0.26.1","release/13.0.26","release/13.0.25.6","release/13.0.25.5","release/13.0.25.4","release/13.0.25.3","release/13.0.25.2","release/13.0.25.1","release/13.0.25","release/13.0.24","release/13.0.23","release/13.0.22","release/13.0.21.9","release/13.0.21.8","release/13.0.21.7","release/13.0.21.6","release/13.0.21.5","release/13.0.21.4","release/13.0.21.3","release/13.0.21.2","release/13.0.21.1","release/13.0.21","release/13.0.20","release/13.0.19.1","release/13.0.19","release/13.0.18.2","release/13.0.18.1","release/13.0.18","release/13.0.17","release/13.0.16","release/13.0.14","release/13.0.13","release/13.0.12","release/13.0.11","release/13.0.10","release/13.0.9","release/13.0.7","release/13.0.6","release/13.0.5","release/13.0.4","release/13.0.3","release/13.0.2","release/13.0.1alpha5","release/13.0.1alpha4","release/13.0.1alpha3","release/13.0.1alpha2","release/13.0.1alpha1","release/12.0.9","release/12.0.8","release/12.0.7","release/12.0.5","release/12.0.4","release/12.0.3","release/2.11.0.20","release/12.0.2","release/12.0.1","release/12.0.0","release/2.11.0.17","release/2.11.0.16","release/2.11.0.15","release/2.11.0.14","release/2.11.0.13","release/2.11.0.12","release/2.11.0.11","release/2.11.0.8","release/2.11.0.7","release/2.11.0.6","release/2.9.0.3","release/2.9.0.2","release/2.9.0.1","release/2.9.0.0","release/2.8.0.6","release/2.8.0.5","release/2.8.0.4","release/2.8.0.3","release/2.8.0.2","release/2.8.0.1","release/2.8.0.0","release/2.7.0.5","release/2.7.0.4","release/2.7.0.3","release/2.7.0.2","release/2.7.0.1beta1.2","release/2.7.0.1beta1.1","release/2.7.0beta1.0","release/2.6.0.4","release/2.6.0.3","release/2.6.0.2","release/2.6.0.1","release/2.6.0.0","release/2.5.1.5","release/2.5.1.4","release/2.5.1.3","release/2.5.1.2","release/2.5.1.1","release/2.5.1","release/2.5.0.2","release/2.5.0.1","release/2.5.0","release/2.4.1.1","release/2.4.1","release/2.4.0","release/2.1.4.8","release/2.1.4.7","release/2.1.4.6","release/2.1.4.5","release/2.1.4.4","release/2.1.4.3","release/2.1.4.2","release/2.1.4.1","release/2.1.4","release/2.1.3","release/2.1.2","release/2.1.1","release/2.1","release/2.0.3","release/2.0.2","release/2.0.1","release/2.0","release/1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26978.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}