Executive brief
Frogman, a tool used for managing FreePBX phone systems, contains a security flaw in its chat console. An attacker with limited administrative access can insert malicious code into system fields like extension names or descriptions. When a higher-level administrator views this information through the Frogman chat interface, the malicious code executes in their browser, potentially allowing the attacker to take over the administrator's account or gain full control of the phone system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Frogman's chat-console markdown formatter within `assets/js/chat.js`. The `formatMarkdown` function incorrectly inserted regex capture groups as raw HTML for inline code, bold text, and links. An attacker with 'write' permissions can inject HTML/JavaScript payloads into user-controlled fields (such as extension names or IVR descriptions). When a higher-privileged administrator views these fields via a chat tool response (e.g., `fm_get_extension`), the payload executes in the context of the victim's session. This can be used to escalate privileges from 'write' to 'admin' by performing unauthorized actions via the viewer's authenticated session. The issue is resolved in version 1.6.6 by implementing proper HTML escaping and URL scheme allowlisting.
Affected products
- mwtcmi Frogman < 1.6.6
Timeline
- 2026-05-13: other: Vulnerability discovered during internal audit
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Version 1.6.6 released