GHSA-xgj6-2gc5-5x9c: Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, astloggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs astloggrabber as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·09:48 PM

Data Sourced

via OSV·09:48 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authorized to open a shell session on the Asterisk server. They also need an administrator to run ast_loggrabber with elevated privileges after the attacker places a malicious Python script in /tmp.

Are systems affected by default?

The described exposure exists where a vulnerable Asterisk or Certified Asterisk version is installed and ast_loggrabber executes its helper script from the world-writable /tmp directory. Exploitation additionally depends on an elevated-privilege user running ast_loggrabber.

What should be done if updates cannot be applied immediately?

Restrict shell access to the Asterisk server and avoid running ast_loggrabber with elevated privileges until the affected installation can be updated. Treat files in /tmp as untrusted and check for unexpected scripts that could be invoked by ast_loggrabber.

Which releases contain the fix?

The fix is available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

GHSA-xgj6-2gc5-5x9c: Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are systems affected by default?

What should be done if updates cannot be applied immediately?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are systems affected by default?

What should be done if updates cannot be applied immediately?

Which releases contain the fix?