FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input field…

FreePBX API module version 17.0.8 and prior contains a command injection vulnerability in the initiateGqlAPIProcess() function. The vulnerability allows authenticated users with valid bearer tokens to execute arbitrary commands on the underlying host through GraphQL mutation input fields that are passed directly to shell_exec() without proper sanitization. Attackers can exploit this by sending GraphQL moduleOperations mutations with backtick-wrapped commands in the module field, gaining code execution privileges as the web server user.