CVE-2026-112195: OS Command Injection in FusionPBX

This vulnerability in FusionPBX up to versions 5.4.4, 5.5.7, and 5.6.5 resides in an unspecified function of app/dialplans/resources/classes/dialplan.php within the Dialplan Editor component. It permits remote OS command injection when an attacker manipulates input to this function. The attack requires high privileges and does not involve user interaction. The vendor was notified but has not responded or provided a fix. Exploit code is publicly available.

Successful exploitation allows a remote attacker with high privileges to execute arbitrary operating system commands on the affected system. This can lead to partial system compromise or unauthorized actions depending on the commands executed. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity with low confidentiality, integrity, and availability impacts.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should apply strict access controls to limit high privilege access to the Dialplan Editor component and monitor for suspicious activity. Stay alert for any future vendor advisories or patches and apply them promptly once available.