CVE-2026-40520

Katalog CVE

CVSS 8.8 · High EPSS 2,4%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada freepbx api. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 patch
• https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql advisory pihak ketiga
• https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3 product
• https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C... product