CVE-2026-108161 in FusionPBX
Summary
by MITRE • 10/10/2026
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
FusionPBX versions through 5.6.5 are affected by a critical operating system command injection vulnerability located within the call_recordings::download() function. This flaw stems from insufficient input validation and sanitization of data derived from SIP signaling headers, specifically the Caller-ID fields used during call setup. The vulnerability allows unauthenticated remote attackers to inject arbitrary shell metacharacters into filenames that are subsequently processed by the underlying operating system commands invoked by the web server application.
The technical mechanism relies on the interaction between the caller ID information and the recording filename template configuration. When the record_name filename template is enabled, FusionPBX constructs file paths for call recordings using data extracted from the SIP INVITE message, including the Caller-ID name and number. If an attacker places a call with maliciously crafted values in these fields, they can embed command substitution syntax such as $(...) or backticks into the string. Because this input is not properly escaped before being passed to system-level commands for file management operations like archiving, the operating system interprets these sequences as executable instructions rather than literal characters.
The exploitation of this vulnerability requires a specific operational context involving privilege escalation through user interaction. While an unauthenticated attacker can inject code into the filename structure during call setup, the actual execution of malicious commands occurs when a privileged user performs an action that triggers the processing of these tainted filenames. Specifically, if a privileged administrator or operator downloads multiple recordings as a ZIP archive, the system invokes shell commands to compress and package the files. At this stage, the injected metacharacters are executed with the privileges of the web server process, which typically runs under a user account with significant access rights on the hosting environment.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of the FusionPBX host system. Successful exploitation allows an attacker to execute arbitrary commands as the web server user, facilitating unauthorized data exfiltration, installation of persistent backdoors, pivoting to other internal network segments, or denial of service through resource exhaustion. Given that PBX systems often handle sensitive voice communications and are connected to critical business infrastructure, this vulnerability poses a significant risk to confidentiality, integrity, and availability.
From a classification perspective, this issue aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK techniques related to Remote Code Execution on Cloud Infrastructure or On-Premises Systems, specifically leveraging command and script interpreters for lateral movement or persistence after initial access is gained through the web application interface.
Mitigation strategies should prioritize immediate patching of FusionPBX to version 5.6.6 or later where this input validation flaw has been addressed by developers. In environments where upgrading is not immediately feasible, administrators can mitigate risk by disabling the record_name filename template if it is not strictly required for operational needs. Additionally, implementing strict web application firewall rules that detect and block common command injection patterns in SIP headers may provide a layer of defense. Regular security audits focusing on input validation across all user-controlled data points within the PBX interface are essential to prevent similar vulnerabilities from being introduced or exploited in other modules.