Skip to content
OpenAdvisories

Product · FreePBX

api

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.2
    CVE-2026-40520

    FreePBX api module Command Injection via GraphQL

    FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with …

    FreePBX api