Skip to content
Threat Feed

Tag

Freepbx

1 brief RSS
high advisory

FreePBX API Module Command Injection Vulnerability (CVE-2026-40520)

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function, allowing authenticated users to execute arbitrary commands via crafted GraphQL mutations.

command-injection freepbx graphql cve-2026-40520
2r 1t 1c