CVE-2026-116786

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The sofia handle sip i refer() function improperly handles raw Refer-To URI parameters and headers within a sip invite params channel-variable block passed to switch ivr originate(). Because the originate parser interprets commas in attacker-controlled values as variable separators, an authenticated caller on a bridged call can inject arbitrary variables into a newly originated leg. Specifically, injecting an execute on originate value allows the invocation of the system dialplan application before the call is answered, leading to the execution of operating-system commands with the privileges of the FreeSWITCH process. This is possible because SIP REFER is enabled by default and only requires a registered account and a call using the off-box transfer path.

Recommendations Update to version 1.11.2.