Fusionpbx

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

Published: 2026-10-10T13:55:12.788Z
Updated: 2026-10-14T02:17:20.624Z

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-10-19T17:00:17.863Z
Updated: 2026-10-19T18:03:19.427Z

FusionPBX before 5.2.0 does not validate a session.

Published: 2024-03-18T00:00:00.000Z
Updated: 2024-11-14T20:16:06.204Z

FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product.

Published: 2024-01-19T03:47:57.987Z
Updated: 2025-05-30T14:26:36.106Z

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.

Published: 2022-05-04T02:49:36.000Z
Updated: 2024-08-03T05:41:11.446Z