What’s Vulnerable › Vulnerabilities
CVE-2026-75600: FreePBX: Authenticated API generatedocs Host Command Injection
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-10-16
- Weakness: CWE-78
Description
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
Affected products
- Sangoma FreePBX: before 17.0.9 — fixed in 17.0.9
How to fix
Upgrade to a fixed version: Sangoma FreePBX 17.0.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-75600 or the next vulnerability affects your stack