CVE-2026-112195 | FusionPBX up to 5.4.4/5.5.7/5.6.5 Dialplan Editor dialplan.php os command injection

October 19, 2026 Yanac

A vulnerability classified as critical was found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection.

This vulnerability is handled as CVE-2026-112195. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More