FreePBX EUVD-2026-88391

Requires an authenticated FreePBX account that is specifically authorized to access the GraphQL API module interface - the description states 'Authenticated access to the api module is required,' so this is not remotely exploitable by anonymous users. The exploitable feature is the PBX API module's documentation generator, which passes an attacker-controlled 'host' parameter into a shell command without validation or escaping (OAuth token validation occurs but does not restrict host). Limiting factors: the attacker must already hold API-module authorization (PR:H) and the GraphQL API module must be enabled/exposed; installations that do not grant API access to untrusted users or that run only vetted operators materially reduce exposure. Affected versions are prior to 17.0.9; patched in 17.0.9.

This is a genuine authenticated RCE (CWE-78) in FreePBX's PBX/GraphQL API documentation generator, but its real-world risk is moderated by the privilege requirement. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H) scores 8.6 and correctly reflects that no user interaction is needed and impact is full compromise, but PR:H means the attacker must already hold an account authorized to reach the API module - not an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a real but not urgent, priority-2 issue rather than a high-CVSS-but-low-risk theoretical bug. The technical impact is high (arbitrary shell command execution as the asterisk service user), and automatability is plausible once credentials exist, but the PR:H gate keeps it from mass, opportunistic exploitation. Note a metadata caveat: the affected-product CPE (cpe:2.3:a:freepbx:security-reporting) and the 'Security Reporting' tag reference the GitHub advisory repository name, not the vulnerable PBX API/GraphQL component - verify the affected component against the vendor advisory.

An attacker with valid FreePBX credentials authorized to use the GraphQL API module (or a lower-privilege user who has escalated to such access) invokes the API documentation generator and supplies a crafted 'host' parameter containing shell metacharacters. Because the code validates the OAuth access token but never escapes or validates 'host', the injected commands execute as the asterisk web/PBX service user. No public exploit code was identified at time of analysis.