Live › vulnerability › CVE-2026-112195
Go to dashboardFusionPBX, an open-source phone system platform, has a flaw in the Dialplan Editor code in app/dialplans/resources/classes/dialplan.php that allows OS command injection. A remote attacker can run operating system commands on the server if the public exploit is used.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running FusionPBX with the Dialplan Editor reachable by users. The sources do not say which roles or settings are needed beyond the web path, so exposure is unknown for installs where the admin interface is restricted to a private network.
No product ranges from the sources yet.
5.4.4, 5.5.7, 5.6.5 and below.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-112195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.