What is the CVSS score of CVE-2026-46512?

CVE-2026-46512 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Frogman are affected by CVE-2026-46512?

A critical vulnerability in Frogman's dialplan API (versions prior to 1.6.2) allows internal users with write permissions to execute arbitrary system commands directly on PBX servers, creating…. A patch is available.

How to fix or mitigate CVE-2026-46512?

Within 24 hours, inventory all systems running Frogman and identify which deployments have user accounts with dialplan API write permissions; restrict these accounts to essential personnel and disable API access where possible. Within 7 days, upgrade all affected Frogman installations to version 1.6.2 following the vendor's documented migration process, verifying successful deployment on each system. Within 30 days, conduct forensic review of API access logs and dialplan configurations for signs of prior exploitation, establish ongoing monitoring of the dialplan API endpoint for suspicious activity, and implement role-based access controls to enforce least-privilege access to all administrative functions.

Frogman CVE-2026-46512

EUVD-2026-45001 CRITICAL

Code Injection (CWE-94)

2026-07-16 GitHub_M

PHP RCE Code Injection Frogman Mwtcmi

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable API with low complexity, but exploitation needs a PERM_WRITE caller so PR:L; injection escapes the app into OS command execution, giving scope change and full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 18:47 vuln.today

Analysis Generated

Jul 16, 2026 - 18:47 vuln.today

CVE Published

Jul 16, 2026 - 18:15 cve.org

CRITICAL 9.9

DescriptionCVE.org

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

AnalysisAI

Code injection in Frogman before 1.6.2 lets an authenticated PERM_WRITE caller of the MCP/HTTP dialplan API inject arbitrary Asterisk directives - including System() and Set(SHELL(...)) - into extensions_custom.conf, yielding remote command execution on the PBX host. The flaw stems from fm_dialplan_apply sanitizing only the context name while passing template parameters such as greeting, dest, url, extension, code, and file into generated dialplan text unchecked. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the CVSS is 9.9 and the fix (v1.6.2) plus root-cause commit are public.

Technical ContextAI

Frogman is a headless PBX-control layer that exposes Asterisk configuration through an MCP interface and an HTTP API. The vulnerable path is Tools/DialplanApply.php, which renders Dialplan/Templates.php output into Asterisk's extensions_custom.conf. Asterisk dialplans are line-oriented and interpret application directives such as System(), Set(SHELL(...)), Goto, and Macro; System()/SHELL() invoke the underlying operating-system shell. The root cause is CWE-94 (Code Injection): before 1.6.2 only Dialplan/TemplateBase.php:38-42 sanitized contextName(), so caller-supplied parameter values were interpolated verbatim into dialplan text. Because a newline or CR in any value breaks out of the intended dialplan line, an attacker could append entirely new directives. The 1.6.2 commit (36a05ff) adds a validateParams() contract, a framework-level rejectDangerous() guard that strips CR/LF/null bytes recursively, and per-parameter whitelists (isDigits, isSoundFile, isDestination, isUrl, etc.).

RemediationAI

Vendor-released patch: 1.6.2 - upgrade Frogman to v1.6.2 or later (https://github.com/mwtcmi/frogman/releases/tag/v1.6.2), which adds the validateParams() enforcement and the rejectDangerous() control-character guard shown in commit 36a05ffa2df1d256b6f6f7c3b66ef77ebe3e458a; review advisory GHSA-pxfc-q72v-jh8m for details. If immediate upgrade is not possible, tightly restrict which principals hold PERM_WRITE on the dialplan API and audit their use of the confirm:true dialplan-apply path, since that permission is the exploitation gate - the trade-off is reduced ability for legitimate automation to modify dialplans. As additional compensating controls, place the MCP/HTTP API behind network ACLs so only trusted management hosts can reach it, and monitor extensions_custom.conf for unexpected System(), SHELL(), Macro, or Goto directives and for injected newlines; these detect but do not prevent abuse by an already-authorized writer, so patching remains the only complete fix.