CVE-2026-40520

FreePBX api module Command Injection via GraphQL

Published Apr 21, 2026 CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed

Description

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

Analysis

Technical impact

FreePBX api module versions up to 17.0.8 allow an authenticated user with a bearer token to inject shell commands into a GraphQL mutation. The vulnerable function directly passes the module field to shell_exec() without validation, enabling arbitrary command execution on the host as the web server user.

Affected Systems

The vulnerability affects FreePBX api module version 17.0.8 and earlier. Users running these versions should verify their installation of FreePBX and assess whether the GraphQL API is exposed to authenticated users.

Risk and Exploitability

The issue carries a CVSS score of 8.6, indicating high severity, and is not listed in the CISA KEV catalog. The EPSS score of 1% indicates a low but non‑zero likelihood of exploitation, and the combination of a privilege‑required authenticated attacker and the ability to run arbitrary commands suggests a significant risk of compromise for the underlying system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreePBX

api

unaffected

Version	Status	Constraints
`0`	affected	≤ 17.0.8
`5f194e39a47e5481e8947f9694304d32724175f6`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freepbx:api:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freepbx

Api

Version	Status	Scheme	Platform
`[0,17.0.8]`	affected	semver	—
`5f194e39a47e5481e8947f9694304d32724175f6`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FreePBX to a version newer than 17.0.8 that includes the defense against command injection.
If an upgrade is not immediately possible, apply the patch from the commit that replaces the insecure shell_exec call with sanitized handling of input.
Restrict access to the GraphQL API to trusted administrators only, or disable the moduleOperations mutation if the API is not required for your deployment.

Generated by OpenCVE AI on October 25, 2026 at 18:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.4% (1.379% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3
https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C136
https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6
https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql

History

Apr 23, 2026 4:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:freepbx:api::::::::

Apr 21, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Freepbx Freepbx api
Vendors & Products		Freepbx Freepbx api

Apr 21, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 21, 2026 1:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
Title		FreePBX api module Command Injection via GraphQL
Weaknesses		CWE-78
References		https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3 https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C136 https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`