CVE-2026-46512
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Frogman prior to version 1.6.2, the fm_dialplan_apply function accepted template parameters (greeting, dest, url, extension, code, file) without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.
Risk Assessment
An attacker with write permissions can remotely execute arbitrary system commands on the Asterisk server, leading to full compromise of the phone system and potentially the entire server.
Recommendation
Immediately upgrade Frogman to version 1.6.2 or later. Restrict dialplan function access to trusted users only.
Original NVD description (English source)
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.