CVE-2026-112195 in FusionPBX
Summary
by MITRE • 10/19/2026
A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within FusionPBX versions up to 5.4.4, 5.5.7, and 5.6.5 represents a critical security flaw located specifically within the Dialplan Editor component. The root cause resides in an unspecified function within the file app/dialplans/resources/classes/dialplan.php. This particular code segment is responsible for handling dial plan configurations, which are central to how FusionPBX routes calls and manages telephony logic. Because this functionality is exposed through a web interface that administrators use to configure system behavior, it becomes a prime target for remote attackers seeking to gain unauthorized control over the underlying server infrastructure. The presence of an unknown function suggests that the vulnerability may stem from insufficient input validation or improper handling of user-supplied data during the parsing or execution of dial plan rules.
The technical nature of this flaw is classified as OS command injection, a severe category of vulnerabilities where an attacker can execute arbitrary operating system commands on the host machine through the vulnerable application. In the context of FusionPBX, which often runs with elevated privileges to manage telephony services and interact with underlying systems like Asterisk or FreeSWITCH, successful exploitation could allow an attacker to achieve full remote code execution. This means that by manipulating specific inputs within the dial plan editor interface, a malicious actor can inject shell commands that are then executed by the server process. The attack vector is explicitly noted as remote, indicating that no local access or prior authentication might be required depending on the specific configuration and whether the vulnerable endpoint is exposed to unauthenticated users or if it requires administrative privileges. However, given the criticality of dial plan management, even authenticated attacks pose a significant risk due to the high privilege level typically associated with such accounts.
The operational impact of this vulnerability is profound, as it compromises the confidentiality, integrity, and availability of the entire FusionPBX deployment. An attacker who successfully exploits this command injection flaw can read sensitive configuration files, exfiltrate call detail records containing private customer information, install backdoors for persistent access, or disrupt telephony services entirely by crashing critical processes. The fact that a public exploit has been published significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation attempts across the internet. This situation is exacerbated by the vendor's lack of response; despite being contacted early regarding this disclosure, there has been no official patch or mitigation guidance provided. Consequently, organizations relying on these affected versions are left without a direct remediation path from the software provider, forcing them to rely on workarounds such as restricting network access to the FusionPBX interface, implementing strict web application firewalls to filter malicious payloads, or upgrading to newer, patched versions if available in later releases not covered by this specific advisory.
From a classification perspective, this vulnerability aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. It also maps closely to MITRE ATT&CK technique T1059, specifically sub-techniques related to command and script interpreters like T1059.004 for Unix Shell Commands or T1059.007 for PowerShell if applicable in mixed environments, though FusionPBX is predominantly Linux-based. The remote nature of the attack places it within the initial access or execution phases of an adversary's kill chain, allowing for immediate foothold establishment on critical communication infrastructure. Security teams must treat this as a high-priority issue due to the combination of remote exploitability, severe impact potential, and the absence of vendor-provided fixes. Immediate mitigation should focus on network segmentation to limit exposure of the FusionPBX web interface, rigorous input validation at any proxy or gateway level before requests reach the application server, and continuous monitoring for anomalous command execution patterns originating from the web service processes.