We are using Fusion PBX version 4.4.6. We ran VAPT test on the PBX and found that there is a "Source Control Management Files accessible" vulnerability.
That's an old release, there are numerous known vulnerabilities that are resolved in a newer release, at minimum 5.0 but the best is running the master branch.