Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck
CVE-2026-108161FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download
High 7.5
In plain English
A high-severity OS command injection in fusionpbx from fusionpbx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37 patch
- https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776 technical-description
- https://github.com/fusionpbx/fusionpbx product
- VulnCheck Advisory: FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download third-party-advisory