CVE-2026-46512 Details
Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.
A critical vulnerability exists in Frogman versions prior to 1.6.2, allowing users with 'PERM_WRITE' privileges to inject arbitrary Asterisk directives into the dialplan. The issue arises in the 'fm_dialplan_apply' function, which accepts template parameters such as greeting, destination, URL, extension, code, and file. These parameters are interpolated directly into Asterisk dialplan text and written to 'extensions_custom.conf' without proper sanitization, except for the context name. As a result, injected directives can execute on matching calls, potentially leading to unauthorized actions such as executing system commands or manipulating call routing.
Users are advised to upgrade to Frogman version 1.6.2, which includes patches for this vulnerability by implementing strict validation of template parameters and correcting the installation path regression that occurred in version 1.6.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mwtcmi/frogman/commit/36a05ffa2df1d256b6f6f7c3b66ef77ebe3e458a | [email protected] | Source CodeVendor |
| https://github.com/mwtcmi/frogman/releases/tag/v1.6.1 | [email protected] | Release NotesVendor |
| https://github.com/mwtcmi/frogman/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mwtcmi/frogman/security/advisories/GHSA-pxfc-q72v-jh8m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mwtcmi Frogman | <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |