CVE-2026-46512

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46512
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46512.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46512
Aliases
  • GHSA-pxfc-q72v-jh8m
Published
2026-07-16T18:15:52.181Z
Modified
2026-07-18T03:47:25.349056218Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping
Details

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fmdialplanapply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensionscustom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERMWRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46512.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mwtcmi/frogman

Affected ranges

Type
GIT
Repo
https://github.com/mwtcmi/frogman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
36a05ffa2df1d256b6f6f7c3b66ef77ebe3e458a
Fixed
cdbdbf371daa939731e330aace9f25140aa727fe
Fixed
2ca0c36caad11e2833d844a3e33fba2e414896cb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46512.json"