api vulnerabilities

2 known vulnerabilities in api from FreePBX. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  api: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-40520Apr 21, 2026FreePBXEPSS 1.38%

  FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a

• 7.5 High severity

  api: Privilege Context Switching Error

  CVE-2025-55210Feb 12, 2026FreePBX

  FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerable to privilege escalation by authenticated users with REST/GraphQL API access. This vulnerability al