---
id: "CVE-2026-112195"
kind: "vulnerability"
aliases: ["CVE-2026-112195"]
title: "FusionPBX: Dialplan Editor flaw allows remote OS command injection"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fusionpbx", "other", "php", "self-hosted", "voip"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T17:17:14+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:10:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112195", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# FusionPBX: Dialplan Editor flaw allows remote OS command injection

FusionPBX, an open-source phone system platform, has a flaw in the Dialplan Editor code in app/dialplans/resources/classes/dialplan.php that allows OS command injection. A remote attacker can run operating system commands on the server if the public exploit is used.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FusionPBX version against the affected range `5.4.4`, `5.5.7`, `5.6.5` and below.
- Look at whether app/dialplans/resources/classes/dialplan.php in the install is the vulnerable version (unknown exact fixed line).

## Fix

- Upgrade FusionPBX to a release newer than the affected versions (exact fixed version unknown from the sources).
- Restrict access to the FusionPBX web interface until patched (unknown from the sources whether a workaround exists).

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112195

## From the sources

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_