Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-116779: FreeSWITCH lets incoming messages execute system commands
CVE-2026-116779 · published today
Summary
Versions of FreeSWITCH before 1.11.3 treat a part of an incoming text message as a command selector. An attacker can craft a message that makes the server run internal commands, potentially exposing settings, controlling calls, or executing operating‑system commands. Upgrade to FreeSWITCH 1.11.3 or later to close the flaw.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| signalwire | freeswitch | < 1.11.3 |
Original advisory text
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
References
- https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p x_refsource_CONFIRM
- https://github.com/signalwire/freeswitch/pull/3135 x_refsource_MISC
- https://github.com/signalwire/freeswitch/commit/7015f6a73ab3d67fed5fbfc277ecfb88... x_refsource_MISC
- https://github.com/signalwire/freeswitch/releases/tag/v1.11.3 x_refsource_MISC
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-77Command Injection
CWE-78OS Command Injection
CWE-749Exposed Dangerous Method or Function
Timeline
Published5 Nov 2026
Updated5 Nov 2026
First seen5 Nov 2026
Track software like this
Free during beta