# CVE-2026-76755: Drupal Gammu SMS Daemon OS command injection

Source: https://junglewise.ai/threats/cve-2026-76755-drupal-gammu-sms-daemon-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76755 · Severity: medium · CVSS 5.9 · Published 2026-09-02

Drupal Gammu SMS Daemon is a module that allows Drupal sites to send and receive SMS messages by integrating with the Gammu SMS service. When configured to use Gammu CLI binaries, the module fails to properly sanitize user-supplied phone numbers and message text before passing them to shell commands, allowing authenticated attackers to inject and execute arbitrary operating system commands on the server. This could lead to full server compromise, data theft, or ransomware deployment.

Technologies: [Drupal Gammu SMS Daemon](https://junglewise.ai/threats/technologies/gammu-sms-daemon). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-76755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76755 being exploited in the wild.

**How severe is CVE-2026-76755?** Medium severity, with a CVSS score of 5.9, published 2 September 2026.

**Which products and versions are affected?** Drupal Gammu SMS Daemon ≤ 8.x-1.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Gammu Smsd ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2026-76755?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76755 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76755?** Check whether you run Drupal Gammu SMS Daemon or Packagist:Https://Packages.Drupal.Org/8 Drupal/Gammu Smsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection (CWE-78) in the GammuSendSMS::sendSms() method. The application constructs shell commands that include user-controlled input (destination phone number and message body) without proper escaping when the Gammu CLI mode is enabled. While the message body has minimal filtering (double-quote conversion), the phone number field is passed directly to the shell unescaped, allowing trivial command termination and chaining (e.g., "; malicious_command"). The message body is also exploitable via inline execution operators like backticks or $() syntax. The vulnerability is reachable through both the web UI (requires "administer gammu" permission) and REST API endpoint (requires API token). All published versions up to 8.x-1.3 are believed vulnerable. The vendor was contacted on 2026-05-17 but did not acknowledge the risk; as of the disclosure date, no patch has been released.

## Affected products

- Drupal Gammu SMS Daemon ≤ 8.x-1.3

## Identifiers

- CVE-2026-76755
- DRUPAL-CONTRIB-2026-100

## Timeline

- 2026-09-02: disclosed
- 2026-05-17: other: Vulnerability reported to maintainer through coordinated disclosure

## References

- [https://www.drupal.org/project/gammu_smsd](https://www.drupal.org/project/gammu_smsd)
- [https://disclosure.cmlara.com/2026/001-Gammu_smsd-RCE/](https://disclosure.cmlara.com/2026/001-Gammu_smsd-RCE/)

## Related threats

- [Drupal Gammu SMS Daemon authorization token disclosure](https://junglewise.ai/threats/cve-2026-76757-drupal-gammu-sms-daemon-authorization-token-disclosure)
- [Drupal Gammu SMS Daemon timing attack in REST API authentication](https://junglewise.ai/threats/cve-2026-76756-drupal-gammu-sms-daemon-timing-attack-in-rest-api-authentication)