{"id":"CVE-2026-108161","published":"2026-10-10T14:16:37.223","lastModified":"2026-10-16T19:18:44.867","description":"FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fusionpbx/fusionpbx","tags":[]},{"url":"https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776","tags":[]},{"url":"https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37","tags":[]},{"url":"https://www.vulncheck.com/advisories/fusionpbx-through-5.6.5-os-command-injection-via-caller-id-in-recording-zip-download","tags":[]}],"exploitRefs":[{"url":"https://github.com/fusionpbx/fusionpbx","tags":[]},{"url":"https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776","tags":[]},{"url":"https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37","tags":[]}],"hasPoc":true,"ai":{"summary":"FusionPBX contains an OS command injection vulnerability in its call recording download functionality that allows unauthenticated attackers to execute arbitrary commands as the web server user by crafting malicious caller ID values during calls. This is particularly dangerous because it can be exploited without authentication and can lead to full system compromise.","exploitability":"Exploitation requires a victim to download multiple recordings as a ZIP while the attacker has placed a call with malicious caller ID data, making it moderately difficult but possible to achieve with social engineering or by targeting systems where users frequently download recordings.","blast_radius":"If exploited, attackers could execute arbitrary commands on the server with web server privileges, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.","remediation":"Upgrade to FusionPBX version 5.6.6 or later to address this vulnerability.","detection":"Monitor for unusual ZIP file download requests in web server logs that contain shell metacharacters in caller ID fields, particularly when these downloads are initiated by users with elevated privileges.","tags":["rce","web","command-injection","voip"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:52.563Z"}}