CVE-2026-112195

MediumCVSS 4.7

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.48%

84th percentile - higher than 84% of all known CVEs

Summary

A flaw was found in FusionPBX up to 5.4.4/5.5.7/5.6.5 in an unknown function of app/dialplans/resources/classes/dialplan.php in the Dialplan Editor component. Manipulation can lead to OS command injection, the attack can be executed remotely, and the exploit has been published and may be used; the vendor did not respond.

Risk Assessment

Remote OS command injection may allow an attacker to take control of the FusionPBX server and access telephony data.

Recommendation

Restrict access to the Dialplan Editor interface to trusted networks and deploy compensating controls, as the vendor has not provided a fix.

Other vulnerabilities in FusionPBX

CVE-2026-108161High
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

Original NVD description (English source)

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS