FusionPBX OS command injection via caller ID

FusionPBX through 5.6.5 allows unauthenticated OS command execution via crafted caller IDs processed in the call_recordings::download() function.

cat cve-2026-108161.json

Vendor: FusionPBX
Product: FusionPBX (through 5.6.5)
CVSS: 7.5
EPSS (exploit probability): N/A
Status: patched
Published: October 11, 2026
Source: https://github.com/fusionpbx/fusionpbx

FusionPBX versions through 5.6.5 contain an OS command injection vulnerability in the call_recordings::download() function. Caller ID data supplied by an unauthenticated caller is passed to a system call without sanitization. An attacker can exploit this by placing a call with a crafted caller ID string containing shell metacharacters.

No authentication is required. The attack vector is the telephony layer, meaning any system accepting inbound calls from untrusted sources is exposed.

Update FusionPBX beyond 5.6.5. If patching is not immediately possible, restrict inbound call routes to trusted SIP trunks and block arbitrary inbound SIP traffic at the network perimeter.

Source: NVD CVE-2026-108161 | FusionPBX on GitHub

Related coverage

~/articles/2026-10-11-fusionpbx-caller-id-os-command-injection

threat intel

FusionPBX Caller ID Bug Lets Attackers Run OS Commands

CVE-2026-108161, CVSS 7.5: unauthenticated OS command injection in FusionPBX 5.6.5 and earlier via crafted caller IDs. Update or restrict exposure.

Oct 11read →