FusionPBX EUVD-2026-96316

Requires the record_name filename template to be enabled (a non-default recording-naming configuration) so that attacker-controlled Caller-ID values become part of the recording filename. The attacker embeds shell metacharacters such as $(...) in the SIP Caller-ID name or number when placing a call; command execution is deferred and only triggers when a privileged/authenticated user downloads multiple recordings as a ZIP, which invokes the vulnerable ln -s and zip shell commands. Limiting factors: non-default config dependency (record_name template), mandatory privileged-user interaction (the ZIP export), and resulting code execution confined to the web-server user's privileges.

This is a genuine but conditional threat rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, score 7.7) tells a consistent story: although the initial injection point is reachable by an unauthenticated remote attacker (PR:N) who simply places a call with a malicious Caller-ID, successful code execution is gated by high attack complexity (AC:H), a specific attack requirement (AT:P), and passive user interaction (UI:P). The CWE-78 OS command injection and the confirmed patch diff (which adds escapeshellarg() around the ln -s and zip paths plus filename sanitization) corroborate the described mechanism, so the technical impact is high (VC/VI/VA:H - arbitrary commands as the web-server user). However, exploitation is NOT self-contained: the record_name filename template must be enabled (non-default) AND a privileged operator must subsequently export multiple recordings as a ZIP, which is why real-world risk is materially lower than the 7.7 headline suggests. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - so there is no public exploit identified at time of analysis, and the absence of exploitation telemetry means risk is driven by the preconditions, not by observed in-the-wild activity. Net: a real priority for FusionPBX operators who have the record_name template enabled, but a lower practical priority for default deployments.

An unauthenticated attacker dials a FusionPBX-handled extension and sets their Caller-ID name or number to a payload containing shell metacharacters such as $(id). The call is recorded under the record_name filename template, and when a privileged user later bulk-downloads recordings as a ZIP, the unsanitized caller-ID-derived filename is passed to a shell ln -s / zip command, executing the attacker's commands as the web-server user. No public exploit code is identified at time of analysis; the mechanism is confirmed only by the vendor patch diff and VulnCheck advisory.