CVE-2026-95615 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Zenitel Connect before 1.11.0 has an OS command injection flaw in its audio messages API, reached through the filename parameter of /api/system/audio_messages. An authenticated remote user can run arbitrary operating system commands as root inside the hiatus application container.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Zenitel Connect before 1.11.0 that expose its web API to users with accounts are exposed. The flaw is in the audio messages upload path, so deployments that do not use that API are less exposed. unknown on whether non-default configuration matters.
Not affected if version-1.11.0-or-later
Who cares self-hosted, zenitel-connect
1.11.0; anything below it is in the stated range./api/system/audio_messages is reachable from networks that hold user accounts.1.11.0 or later.OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.