{"id":"CVE-2026-112195","kind":"vulnerability","aliases":["CVE-2026-112195"],"related":[],"title":"FusionPBX: Dialplan Editor flaw allows remote OS command injection","description":"A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"FusionPBX, an open-source phone system platform, has a flaw in the Dialplan Editor code in app/dialplans/resources/classes/dialplan.php that allows OS command injection. A remote attacker can run operating system commands on the server if the public exploit is used.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusionpbx","other","php","self-hosted","voip"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed FusionPBX version against the affected range `5.4.4`, `5.5.7`, `5.6.5` and below.\n- Look at whether app/dialplans/resources/classes/dialplan.php in the install is the vulnerable version (unknown exact fixed line).","fix":"- Upgrade FusionPBX to a release newer than the affected versions (exact fixed version unknown from the sources).\n- Restrict access to the FusionPBX web interface until patched (unknown from the sources whether a workaround exists).","status":"open","published_at":"2026-10-19T17:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:10:17+00:00","updated_at":"2026-10-25T04:10:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FusionPBX to a release newer than the affected versions (exact fixed version unknown from the sources).\n- Restrict access to the FusionPBX web interface until patched (unknown from the sources whether a workaround exists).","reach":"internet","title":"FusionPBX: Dialplan Editor flaw allows remote OS command injection","impact":"high","summary":"FusionPBX, an open-source phone system platform, has a flaw in the Dialplan Editor code in app/dialplans/resources/classes/dialplan.php that allows OS command injection. A remote attacker can run operating system commands on the server if the public exploit is used.","category":"other","nicknames":[],"who_cares":["fusionpbx","self-hosted","voip","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the FusionPBX server remotely.","analyst_note":"Find the vendor or advisory fix version and whether the Dialplan Editor requires login; the NVD entry alone does not say.","how_to_check":"- Check the installed FusionPBX version against the affected range `5.4.4`, `5.5.7`, `5.6.5` and below.\n- Look at whether app/dialplans/resources/classes/dialplan.php in the install is the vulnerable version (unknown exact fixed line).","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running FusionPBX with the Dialplan Editor reachable by users. The sources do not say which roles or settings are needed beyond the web path, so exposure is unknown for installs where the admin interface is restricted to a private network.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3357,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112195':12A,15A '-2026':11A,14A '/5.5.7/5.6.5':73C '5.4.4':72C 'affect':75C 'allow':5A,42B 'app/dialplans/resources/classes/dialplan.php':40B,84C 'attack':48B,100C 'code':38B 'command':8A,44B,53B,97C 'compon':87C 'contact':117C 'cve':10A,13A 'dialplan':2A,36B,88C 'disclosur':121C 'earli':118C 'editor':3A,37B,89C 'element':76C 'execut':90C,103C 'exploit':60B,106C 'file':83C 'flaw':4A,33B,64C 'found':67C 'function':80C 'fusionpbx':1A,16B,23B,69C 'host':21B 'inject':9A,45B,98C 'lead':94C 'manipul':92C 'may':111C 'open':26B 'open-sourc':25B 'oper':51B 'os':7A,43B,96C 'phone':28B 'php':18B 'platform':30B 'public':59B 'publish':109C 'remot':6A,47B,104C 'respond':125C 'run':50B 'self':20B 'self-host':19B 'server':56B 'sourc':27B 'system':29B,52B 'unknown':79C 'use':62B,113C 'vendor':115C 'voip':22B 'way':128C","nicknames":[],"mitigations":[],"who_affected":"Teams running FusionPBX with the Dialplan Editor reachable by users. The sources do not say which roles or settings are needed beyond the web path, so exposure is unknown for installs where the admin interface is restricted to a private network.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112195","severity":null,"published_at":"2026-10-19T17:17:14+00:00","modified_at":"2026-10-19T20:43:24+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}