CVE-2026-116786 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH builds an originate command from attacker-supplied SIP Refer-To values without escaping commas, so an injected variable can set an execute_on_originate action. An authenticated SIP caller on a bridged call can then run operating-system commands with the FreeSWITCH process privileges.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments running FreeSWITCH before 1.11.2 that accept SIP calls from registered accounts are exposed, since REFER is enabled by default. Systems that accept no SIP traffic, or only admin-restricted or non-REFER calls, have a smaller exposure. Operators who already run 1.11.2 or later are not affected.
Not affected if no-sip-exposure, version-1.11.2-or-later
Who cares freeswitch, self-hosted, sip, telecom, voip
fs_cli -x version or the FreeSWITCH package version, and compare against 1.11.2.1.11.2.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected execute_on_originate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.