FusionPBX Dialplan Editor dialplan.php os command injection

published 2026-10-19 21 d ago modified 2026-10-19 20 d ago also EUVD-2026-104483

cvss: 4.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 5.0%; EPSS 5.0% chance of exploitation in 30 days, percentile 92%
public exploits: 0; none known

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 20 d ago (2026-10-19)

Exploit prediction

5.04% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/jasonbernier/Dialplan-Escape-RCE/blob/main/exploit.py referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CNA	3.0	4.7	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CNA	2.0	5.8	AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C
CNA	4.0	2.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	5.8	AV:N/AC:L/Au:M/C:P/I:P/A:P

Affected products

n/a FusionPBX

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-77 Improper Neutralization of Special Elements used in a Command

References

github.com /jasonbernier/Dialplan-Escape-RCE/blob/main/exploit.py
exploit
vuldb.com /vuln/422297
vdb-entry
vuldb.com /vuln/422297/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-112195
third-party-advisory
vuldb.com /submit/984968
third-party-advisory

Sources

CVE List CVE-2026-112195
NVD CVE-2026-112195

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary