{"id":"CVE-2024-53564","aliases":["EUVD-2024-51996","GHSA-ccwq-3vpf-86cw"],"status":"disputed","title":"An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of...","description":"A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.","severity":{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00347,"percentile":0.28508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434","CWE-94"],"published":"2024-12-02T00:00:00Z","modified":"2026-10-28T02:31:12Z","products":[{"vendor":"coalescent_systems","product":"freepbx"},{"vendor":"freepbx","product":"freepbx"},{"vendor":"sangoma","product":"freepbx"}],"references":[{"url":"https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903","tags":["Third Party Advisory","web"]},{"url":"https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53564","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccwq-3vpf-86cw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53564.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-53564","description":"A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.","status":"disputed","published":"2024-12-02T00:00:00Z","modified":"2025-01-14T16:41:16.578Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-51996","description":"A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.","status":"published","published":"2024-12-02T00:00:00Z","modified":"2025-01-14T16:41:16Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:04:19.834715Z"}],"ghsa":[{"id":"GHSA-ccwq-3vpf-86cw","title":"An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of...","description":"An authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of freepbx v17.0.19.17 allows attackers to execute arbitrary code via uploading a crafted file.","status":"published","published":"2024-12-02T18:31:56Z","modified":"2025-01-08T21:33:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-434"],"updated_at":"2026-11-02T14:59:26.383945Z"}],"nvd":[{"id":"CVE-2024-53564","description":"A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.","status":"disputed","published":"2024-12-02T18:15:11.353Z","modified":"2026-06-17T08:08:59.597Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"CVE-2024-53564","description":"A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do.","status":"published","published":"2024-12-02T00:00:00Z","modified":"2026-10-28T02:31:12.906538575Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:44.451316Z"}]}}