Command Injection Risk in FreePBX API Module Affects Multiple Users

CVE-2026-40520

What is CVE-2026-40520?

A command injection vulnerability exists in the FreePBX API module, specifically in the initiateGqlAPIProcess() function. The issue arises from the handling of GraphQL mutation input fields passed directly to shell_exec() without proper sanitization or escaping. This allows an authenticated attacker, equipped with a valid bearer token, to manipulate GraphQL moduleOperations mutations. By wrapping commands in backticks within the module field, an attacker can execute arbitrary commands on the host system using the web server user's privileges. Users are advised to apply the latest patches to mitigate this risk.

References