PT-2026-33931 · Freepbx · Freepbx

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40520

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX api module versions prior to 17.0.9

Description An issue exists in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation containing backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

Recommendations Update to a version newer than 17.0.8. As a temporary workaround, restrict access to the initiateGqlAPIProcess() function or the GraphQL moduleOperations mutation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40520

Affected Products

Freepbx

References · 6

• https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40520 · Security Note
• https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C136 · Note
• https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3 · Note
• https://twitter.com/VulmonFeeds/status/2046681972051722455 · Twitter Post
• https://vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql · Note