# CVE-2026-75600: FreePBX API command injection in documentation generator

Source: https://junglewise.ai/threats/cve-2026-75600-freepbx-is-an-open-source-ip-pbx-prior-to-version-17-0-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-75600 · Severity: info · Published 2026-09-28

FreePBX is an open-source telephone system (IP PBX) that manages business phone calls and voicemail. Authenticated administrators with API access can execute arbitrary system commands on the server by providing a malicious hostname parameter to the API documentation generator. An attacker with compromised admin credentials or authorized API access could take full control of the phone system and underlying server.

Technologies: [FreePBX](https://junglewise.ai/threats/technologies/freepbx-freepbx). Vendors: [FreePBX](https://junglewise.ai/threats/vendors/freepbx).

## Quick answers

**Is CVE-2026-75600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75600 being exploited in the wild.

**How severe is CVE-2026-75600?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** FreePBX prior to 17.0.9.

**Is there a fix for CVE-2026-75600?** A patch was published on 2026: version 17.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75600 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75600?** Check whether you run FreePBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The API module's documentation generator accepts a host parameter that is directly concatenated into a shell command without proper escaping or validation, despite validating the OAuth token. This allows authenticated command injection with network access. An attacker with privileges to the API module can execute arbitrary shell commands as the asterisk system user, gaining full compromise of the PBX system. The vulnerability was introduced in 2023 and patched in version 17.0.9.

## Affected products

- FreePBX FreePBX prior to 17.0.9

## Timeline

- 2026-07-09: disclosed
- 2026: patched: version 17.0.9

## References

- [https://github.com/FreePBX/security-reporting/security/advisories/GHSA-79rg-3xp6-rqq6](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-79rg-3xp6-rqq6)

## Related threats

- [FreePBX Superfecta arbitrary PHP code execution](https://junglewise.ai/threats/cve-2026-54710-freepbx-is-an-open-source-ip-pbx-prior-to-versions-16-0-40-and-17)
- [FreePBX backup module arbitrary code execution via path traversal](https://junglewise.ai/threats/cve-2026-54708-freepbx-is-an-open-source-ip-pbx-prior-to-versions-16-0-72-and-17)
- [FreePBX path traversal in soundlang file upload leading to RCE](https://junglewise.ai/threats/cve-2026-54675-freepbx-is-an-open-source-ip-pbx-prior-to-versions-16-0-10-and-17)
- [FreePBX command injection in User Control Panel](https://junglewise.ai/threats/cve-2026-54674-freepbx-is-an-open-source-ip-pbx-prior-to-versions-16-0-39-and-17)
- [FreePBX Music on Hold module command injection](https://junglewise.ai/threats/cve-2026-45562-freepbx-is-an-open-source-ip-pbx-prior-to-versions-16-0-4-and-17)