Security Advisory

CVE-2026-46512

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-16 18:15:52

Last updated 2026-07-18 03:05:10

Assigner GitHub_M

CVSS score 9.9

State PUBLISHED

Description

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

← Browse all CVEs View on cve.org ↗