CVE-2026-75600 is an OS command injection flaw (CWE-78) in the GraphQL api module of FreePBX. The documentation generator puts an unchecked host parameter into a shell command. The record rates it High at 8.8. Version 17.0.9 fixes it, so update.
What's affected
The record says FreePBX before 17.0.9 is affected, and the advisory (GHSA-79rg-3xp6-rqq6) lists 17.0.9 as patched. The component is the api module, the GraphQL interface.
An authenticated user who is allowed to use that interface is required. The advisory points out that administrators are at more risk if they give API access to less trusted people or to automation tools, and that most administrators do not offer that level of access to end users.
Severity, as two sources state it. The record gives 8.8 (High) under CVSS 3.1. The advisory scores it under CVSS 4.0 at 8.6 (High), using a high privileges requirement. The scores are close, though the privilege assumptions differ, and so does the sense of how easy it is for an ordinary user.
How to check if you're exposed
On the FreePBX host, list module versions with the command line tool.
fwconsole ma list | grep -E "api|core"
fwconsole ma showupgrades
The module pages in the administrator interface show the same information under Module Admin. Compare the version of the module named in this CVE with the fixed version in the advisory.
What to do now
- Update the api module to the latest version, 17.0.9 or later.
- List which users, tokens and automation tools can call the GraphQL API, and remove any you do not need.
- Make sure the API is not reachable from untrusted networks. Use the FreePBX Firewall module for that.
- Rotate API credentials for automation that has been running a long time.
- Check the web server and asterisk account logs for commands you do not recognise.
Why it matters
The class is OS command injection, CWE-78. The advisory says the documentation generator accepts an authenticated host parameter and builds a shell command with it. The code validates the OAuth token before running, but does not validate or escape host. Authentication therefore gates the call without making its argument safe.
That distinction matters in many applications. Checking who is calling does not tell you whether what they sent is safe, and a shell is the worst place for string concatenation. Safer designs call programs with an argument list, and validate the host against a strict pattern. The result runs as the FreePBX web or PBX service user, usually asterisk. The KEV flag is false.
Quick check
Is authentication enough to stay safe?
No. The attacker needs API access, but any user with that access can run commands. Limit who has it and update.
How does this relate to the Music on Hold CVE?
Both are command injection issues in separate FreePBX modules, and each has its own fixed version. Update every module that has an advisory.
Sources
Last reviewed: 18 October 2026.
