CVE-2026-108161

Summary

FusionPBX contains an OS command injection vulnerability in its call recording download functionality that allows unauthenticated attackers to execute arbitrary commands as the web server user by crafting malicious caller ID values during calls. This is particularly dangerous because it can be exploited without authentication and can lead to full system compromise.

Exploitability

Exploitation requires a victim to download multiple recordings as a ZIP while the attacker has placed a call with malicious caller ID data, making it moderately difficult but possible to achieve with social engineering or by targeting systems where users frequently download recordings.

Blast radius

If exploited, attackers could execute arbitrary commands on the server with web server privileges, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Detection

Monitor for unusual ZIP file download requests in web server logs that contain shell metacharacters in caller ID fields, particularly when these downloads are initiated by users with elevated privileges.

Prioritized remediation

Upgrade to FusionPBX version 5.6.6 or later to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.