CVE-2026-40520
FreePBX api module Command Injection via GraphQL
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
| CWE | CWE-78 |
| Vendor | freepbx |
| Product | api |
| Published | Apr 21, 2026 |
| Last Updated | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for freepbx api
Be the first to know when new high vulnerabilities affecting freepbx api are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
FreePBX / api
0 ≤ 17.0.8
References
github.com: https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 github.com: https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3 github.com: https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C136 vulncheck.com: https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql
Credits
🔍 M. Cory Billington of theyhack.me