CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

The risk is high because an unauthenticated attacker can execute arbitrary commands on the server in the context of the web server user, potentially leading to confidentiality, integrity, and availability breaches.

Immediately update FusionPBX to a patched version and disable or secure the record_name filename template. Additionally, restrict access to recording download functionality to authenticated and privileged users only.