CVE-2026-40520

HIGH

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec()...

Affects 1 product across 1 vendor.

CVSS 3.18.8
CVSS v48.6
EPSS2.4%
Percentile84th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function, allowing authenticated users to execute arbitrary commands.

BSID: BS-2026-GLOBAL-272068-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-40520?
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function, allowing authenticated users to execute arbitrary commands.
What is the CVSS score for CVE-2026-40520?
CVE-2026-40520 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.4%.
Is CVE-2026-40520 actively exploited?
No confirmed active exploitation of CVE-2026-40520 as of 2026-05-30.
How do I remediate CVE-2026-40520?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-40520?
CVE-2026-40520 affects Freepbx Api.
Vulnerability Details
CVE IDCVE-2026-40520
BSIDBS-2026-GLOBAL-272068-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2026-04-21
Last Modified2026-04-23
ICS Relevance15%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands due to lack of sanitization or escaping in the initiateGqlAPIProcess() function.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Freepbx Api < 17.0.8
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 177 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0419b719256a4f1bfb5606e97f9d3117959fa33d79951557f4806f508b334cbb80a0d956331b1919b371ce6eda3c794d6556cd6cac8a62c32fabcbdb4d1a3410
Related CVEs affecting Freepbx
CVE-2014-7235 10.0 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording ... CVE-2024-58294 8.8 FreePBX 16 contains an authenticated remote code execution vulnerability in t... CVE-2023-26566 8.6 Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for... CVE-2014-1903 7.5 admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 befor... CVE-2007-2191 6.8 Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow re...
View all Freepbx CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →