CVE-2026-75600: FreePBX: Authenticated API generatedocs Host Command Injection
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBXto a version that resolves this vulnerability.Fixed in 17.0.9
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and authorized to access FreePBX's GraphQL API module interface. The vulnerable documentation-generator path also validates a generated OAuth access token before command execution.
Which deployments are affected?
FreePBX versions prior to 17.0.9 are affected where users have access to the GraphQL API module interface. The issue is patched in version 17.0.9.
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary shell command execution as the FreePBX web/PBX service user, which is typically the asterisk user.