CVE-2026-40520

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40520
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40520.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40520
Published
2026-04-21T12:41:05.281Z
Modified
2026-07-08T08:13:12.895020783Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreePBX api module Command Injection via GraphQL
Details

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40520.json",
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/freepbx/api

Affected ranges

Type
GIT
Repo
https://github.com/freepbx/api
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ca10ea7d9d72d118ab40484ec3f969aff25f685d
Fixed
5f194e39a47e5481e8947f9694304d32724175f6
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:freepbx:api:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "17.0.8"
        }
    ]
}

Affected versions

release/15.*
release/15.0.1alpha1
release/15.0.1alpha2
release/15.0.1alpha3
release/15.0.1alpha4
release/15.0.2
release/15.0.2.1
release/15.0.3
release/15.0.3.1
release/15.0.3.2
release/15.0.3.3
release/15.0.3.4
release/15.0.3.5
release/15.0.3.6
release/15.0.3.7
release/16.*
release/16.0.2
release/16.0.3
release/16.0.4
release/16.0.4.1
release/16.0.4.10
release/16.0.4.2
release/16.0.4.3
release/16.0.4.4
release/16.0.4.5
release/16.0.4.6
release/16.0.4.7
release/16.0.4.8
release/16.0.4.9
release/16.0.5
release/16.0.6
release/16.0.7
release/16.0.8
release/16.0.9
release/17.*
release/17.0.1
release/17.0.1.1
release/17.0.1.2
release/17.0.1.3
release/17.0.1.4
release/17.0.1.5
release/17.0.1.6
release/17.0.1.7
release/17.0.2
release/17.0.3
release/17.0.4
release/17.0.5
release/17.0.6
release/17.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40520.json"