CVE-2026-75600

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.9

Description Authenticated users with access to the GraphQL api module interface can execute arbitrary shell commands. The issue occurs because the PBX API module documentation generator uses an authenticated host parameter to construct a shell command without proper validation or escaping. Although the system validates the OAuth access token, the lack of sanitization for the host variable allows command execution with the privileges of the FreePBX web/PBX service user, typically asterisk.

Recommendations Update to version 17.0.9.