{"uuid": "74a33280-1a8f-47b4-8cc6-2e7bd8eb4a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108161", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117416966589404042", "content": "CVE-2026-108161 FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108161https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776https://github.com/fusionpbx/fusionpbxhttps://www.vulncheck.com/advisories/fusionpbx-through-5.6.5-os-command-injection-via-caller-id-in-recording-zip-download#fusionpbx#CVE_2026_108161#bot", "creation_timestamp": "2026-10-10T13:58:46.856938Z"}