CVE-2026-40520: FreePBX api module Command Injection via GraphQL
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shellexec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX api moduleto a version that resolves this vulnerability.Fixed in 17.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40520?
CVE-2026-40520 has a critical severity rating due to the potential for command injection.
How do I fix CVE-2026-40520?
To fix CVE-2026-40520, update the FreePBX api module to version 17.0.9 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-40520?
CVE-2026-40520 is a command injection vulnerability that can allow attackers to execute arbitrary commands.
Who is affected by CVE-2026-40520?
CVE-2026-40520 affects users of the FreePBX api module version 17.0.8 and earlier.
What components of FreePBX are impacted by CVE-2026-40520?
CVE-2026-40520 impacts the initiateGqlAPIProcess() function within the FreePBX api module.