CVE-2026-108161

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 5.6.6

Description An OS command injection issue exists in the call recordings::download() function. Unauthenticated attackers can execute commands as the web server user by placing calls with malicious caller ID values. When the record name filename template is enabled, shell metacharacters such as $(...) can be embedded in the Caller-ID name or number. The execution occurs when a privileged user downloads multiple recordings as a ZIP file.

Recommendations Update FusionPBX to version 5.6.6 or later. As a temporary mitigation, disable the record name filename template.