CVE-2026-46512 | BDVDB-2026-348951 Detail

Description#

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-16Record published in the CVE List.
2. Version 22026-07-18Most recent update recorded in the CVE List.