Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40520: FreePBX API lets logged-in user run any command

CVE-2026-40520 · published 6 months ago

Summary

The FreePBX API module (up to version 17.0.8) lets a user who has a valid login token send specially crafted data that runs any command on the server. This can let an attacker control the machine the software runs on. Apply the vendor's update or disable the API module until it is patched.

What to do

Update freepbx api to version 17.0.8 or later.

Affected software

Vendor	Product	Affected versions
freepbx	api	< 17.0.8 `cpe:2.3:a:freepbx:api::::::::`

Original advisory text

FreePBX api module Command Injection via GraphQL

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

References

https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api... Product
https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api... Product
https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 Patch
https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-gr... Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40520... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-40520 Vendor Advisory
https://github.com/FreePBX/api Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published21 Apr 2026

Updated3 Nov 2026

First seen21 Apr 2026

Sources

CVE-2026-40520 · NVD

CVE-2026-40520 · MITRE

CVE-2026-40520 · OSV

Track software like this

Free during beta