Which versions of Freepbx are affected by CVE-2026-40520?

FreePBX API module versions 17.0.8 and earlier contain a command injection vulnerability that allows authenticated administrators to execute arbitrary operating system commands on the FreePBX server.. A patch is available.

How to fix or mitigate CVE-2026-40520?

Within 24 hours: Inventory all FreePBX deployments and identify instances running API module 17.0.8 or earlier. Within 7 days: Apply vendor patch via GitHub commit 5f194e39 to all affected FreePBX installations; audit and rotate all API bearer tokens and admin credentials. Within 30 days: Implement network access controls restricting GraphQL API access to trusted networks and review logs for unauthorized mutation attempts.

Freepbx CVE-2026-40520

Q: What is the CVSS score of CVE-2026-40520?

CVE-2026-40520 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-24086 HIGH

OS Command Injection (CWE-78)

2026-04-21 VulnCheck

GHSA-h2vx-h73q-6q6w

Command Injection Freepbx API

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 13:33 vuln.today

CVSS changed

Apr 21, 2026 - 13:22 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 13:15 euvd

EUVD-2026-24086

Analysis Generated

Apr 21, 2026 - 13:15 vuln.today

Patch released

Apr 21, 2026 - 13:15 nvd

Patch available

CVE Published

Apr 21, 2026 - 12:41 nvd

HIGH 8.6

DescriptionCVE.org

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

AnalysisAI

Command injection in FreePBX API module 17.0.8 and earlier allows authenticated attackers with valid bearer tokens to execute arbitrary operating system commands as the web server user via malicious GraphQL mutations. The initiateGqlAPIProcess() function passes unsanitized GraphQL moduleOperations mutation input directly to shell_exec(), enabling backtick-wrapped command execution. While requiring high privileges (PR:H), the vulnerability provides complete system compromise within the web server context (CVSS 8.6). Vendor patch available via GitHub commit 5f194e39. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

FreePBX is an open-source web-based GUI for managing Asterisk PBX systems. The vulnerability resides in the API module's GraphQL implementation, specifically in the initiateGqlAPIProcess() function within ApiGqlHelper.class.php. This function accepts GraphQL mutation input for module operations and passes field values directly to PHP's shell_exec() without input validation, escaping, or sanitization. The CWE-78 (OS Command Injection) flaw occurs when the module field containing backtick-enclosed commands is interpolated into shell commands. The affected CPE (cpe:2.3:a:freepbx:api:*:*:*:*:*:*:*:*) indicates all versions through 17.0.8 of the FreePBX API module contain this flaw. GraphQL's flexible mutation syntax combined with bearer token authentication creates an authenticated remote code execution primitive that bypasses traditional web application firewalls focused on REST API patterns.

RemediationAI

Apply the vendor-released patch available in GitHub commit 5f194e39a47e5481e8947f9694304d32724175f6 (https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6). This commit addresses the command injection by implementing proper input sanitization in the initiateGqlAPIProcess() function. Upgrade to FreePBX API module version 17.0.9 or later once a tagged release incorporating this fix is published. As interim mitigation if patching is delayed: (1) restrict network access to the FreePBX GraphQL API endpoint to trusted management networks only via firewall rules or reverse proxy ACLs - this reduces attack surface but does not eliminate insider threat risk, (2) audit and rotate all bearer tokens with API access, implementing short token lifetimes and principle of least privilege, (3) enable audit logging for all GraphQL mutation operations to detect exploitation attempts via unusual moduleOperations patterns, (4) consider disabling the GraphQL API functionality entirely if not operationally required (note: this may break dependent FreePBX modules or integrations). Review web server and application logs for GraphQL requests containing backtick characters or shell metacharacters in module fields as potential indicators of compromise.