FusionPBX CVE-2026-112195

Requires an authenticated FusionPBX account with access to the Dialplan Editor; the attacker supplies a manipulated value processed by app/dialplans/resources/classes/dialplan.php to inject operating-system commands. The primary limiting factor is privilege: dialplan management is an administrative function (PR:H), so pre-authentication exploitation is not indicated - this is most dangerous on multi-tenant or lower-trust-admin deployments where such accounts are broadly granted. Affected versions are FusionPBX up to 5.4.4, 5.5.7, and 5.6.5; no vendor patch is referenced, so default installations of those versions remain exposed to any user holding dialplan-edit rights. No special non-default feature toggle is required beyond normal access to the Dialplan Editor.

Signals are mixed and one is internally inconsistent. The only CVSS provided is a CVSS 4.0 vector from VulDB (the assigning CNA) scoring just 2.0, driven by PR:H (requires a high-privilege/authenticated account) combined with Low vulnerable-system impact (VC:L/VI:L/VA:L). That Low impact rating conflicts with the vulnerability class: CWE-77 OS command injection in the Dialplan Editor realistically yields arbitrary command execution as the web/telephony service account, which is High impact, not Low - treat VulDB's impact scoring as understated. A public exploit exists (jasonbernier/Dialplan-Escape-RCE), so this is 'publicly available exploit code exists', NOT confirmed active exploitation. There is no CISA KEV listing and no EPSS score in the input, so widespread opportunistic exploitation cannot be confirmed or ruled out from the data. The practical risk gate is privilege: exploitation requires an authenticated account with access to the Dialplan Editor (PR:H), so this is primarily an authenticated-admin-to-host-RCE / privilege-escalation issue rather than a pre-auth internet worm. Compounding the picture, the vendor was contacted but did not respond and no patch is referenced, meaning affected deployments likely remain unpatched. Net: moderate-to-high real risk for exposed/multi-tenant FusionPBX instances despite the deceptively low 2.0 CVSS, because PR:H gates it but the true impact is full command execution.

An attacker who already holds a FusionPBX account with Dialplan Editor access (e.g., a low-trust tenant admin on a shared VoIP platform) opens the dialplan editor and inserts a crafted value that breaks out of dialplan handling in dialplan.php, causing the server to run attacker-supplied OS commands. Because a public exploit (exploit.py) is available, this requires little custom development. The result is command execution on the underlying PBX host under the service account, enabling full compromise of the telephony server.