FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to… (CVE-2026-108161)

CVE-2026-108161 describes an OS command injection vulnerability in FusionPBX up to version 5.6.5 within the call_recordings::download() function. Attackers can exploit this by placing calls with specially crafted caller ID names or numbers containing shell metacharacters such as $(...). If the record_name filename template feature is enabled, these injected commands execute with the privileges of the web server user when a privileged user downloads multiple call recordings as a ZIP file. This vulnerability requires no authentication but does require user interaction to trigger the command execution during the download process.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the server running FusionPBX with the privileges of the web server user. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the record_name filename template feature if possible to prevent injection of shell metacharacters via caller ID. Additionally, restrict access to call recordings download functionality to trusted users and monitor for suspicious caller ID inputs. Avoid downloading multiple recordings as ZIP archives if the feature is enabled and untrusted calls are possible.