---
id: "CVE-2026-116779"
kind: "vulnerability"
aliases: ["CVE-2026-116779"]
title: "FreeSWITCH: crafted SIP MESSAGE lets authenticated peers run system commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["freeswitch", "runtime", "self-hosted", "sip", "telecom"]
not_affected_if: ["fixed-1.11.3-or-later", "inbound-chat-disabled"]
published_at: "2026-11-05T20:17:44+00:00"
first_seen_at: "2026-11-05T20:40:45+00:00"
updated_at: "2026-11-05T20:42:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116779", "first_seen_at": "2026-11-05T20:40:45+00:00"}]
exploit_sources: []
---

# FreeSWITCH: crafted SIP MESSAGE lets authenticated peers run system commands

FreeSWITCH before 1.11.3 treats the left side of a plus sign in the To user of an inbound SIP MESSAGE as a chat protocol selector, and the api protocol passes the message to the API command executor. An authenticated peer whose message is accepted can run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `fs_cli -x 'version'` or check the installed FreeSWITCH version; affected versions are those before `1.11.3`.
- Look at the sofia profile XML (internal and external) for inbound chat being enabled; it is enabled on the stock profiles.
- Review directory users for accounts without password material, which the description says can remove the authentication barrier in affected configurations.

## Fix

- FreeSWITCH: upgrade to `1.11.3`.

## Timeline

- 2026-11-05T20:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116779

## Documents

- [advisory] Vendor advisory: github.com https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p
- [fix] Patch: github.com https://github.com/signalwire/freeswitch/commit/7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86
- [fix] Release notes: github.com https://github.com/signalwire/freeswitch/releases/tag/v1.11.3

## From the sources

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_