FreePBX is an open source IP PBX that allows authenticated users to access a GraphQL API module. Prior to version 17.0.9 the module’s documentation generator accepts a host parameter that is incorporated directly into a shell command. While the OAuth token is validated, the host input is not escaped or validated. An attacker who can authenticate and has permission to use the API can therefore inject arbitrary shell commands and execute them as the web/PBX service user (usually asterisk). This results in remote code execution with the permissions of the service account, potentially allowing full compromise of the PBX system.

All installations of FreePBX running a version older than 17.0.9 are affected. The vulnerability applies to the freepbx:security-reporting product. Users should confirm their installed version and upgrade if it is any version prior to 17.0.9.

The CVSS score of 8.6 indicates high severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. The attack requires authenticated access to the GraphQL API, but because the host parameter is not sanitized, an authenticated attacker can achieve arbitrary command execution. The lack of publicly reported exploitation and the high severity imply a significant risk for any system that exposes the API to potential attackers.