FusionPBX vulnerabilities
CVEs whose affected-version data names the FusionPBX package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-112195Medium· 4.7PoCFusionPBX Dialplan Editor dialplan.php os command injection
A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os co…
▾ Twilightvia CVEORG
CVE-2026-108161High· 7.5FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filena…
▾ Twilightfusionpbx · fusionpbxEPSS 1.1%via NVD