CVE-2026-40520

FreePBX API module versions 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where unsanitized GraphQL mutation inputs are passed directly to shell_exec(). An authenticated user possessing a valid bearer token can exploit this flaw by injecting backtick-wrapped commands through the module field in a moduleOperations mutation to execute arbitrary commands on the host as the web server user. The vulnerability has a CVSS score of 7.2 (HIGH) with a network attack vector, low complexity, and high privilege requirements. The impact is severe, affecting confidentiality, integrity, and availability of the affected system. While the CVSS indicates significant risk, the EPSS score of 0.0011 suggests this vulnerability currently ranks lower in exploit prevalence compared to other CVEs. There is no current evidence of active exploitation, as indicated by the CVE's absence from CISA's Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. However, organizations running affected FreePBX versions should prioritize patching, as the vulnerability requires only authentication and is straightforward to exploit once access is obtained.