FusionPBX versions up to 5.6.5 contain an OS command injection flaw within the call_recordings::download() function. The vulnerability allows an attacker to embed shell metacharacters such as $(...) directly into the Caller-ID name or number of a call. When the record_name filename template is enabled, downloading multiple recordings as a ZIP executes the injected command under the web server user’s privileges, providing full command‑execution rights on the host.

FusionPBX FusionPBX, all releases up to and including 5.6.5. The flaw affects the call_recordings module that handles ZIP downloads of call recordings.

The CVSS score of 7.7 classifies this as a high‑severity issue. The EPSS score of 1% indicates that the vulnerability has a measurable likelihood of being exploited, though it remains relatively low. The exploit requires placement of malicious calls and subsequent ZIP download by a privileged user, which makes exploitation plausible. The vulnerability is not listed in CISA KEV but the severity and nature of the flaw warrant prompt attention. Potential attackers can gain arbitrary command execution on the web server if they control the Caller-ID field and an authorized user later triggers the download process.