CVE-2026-46512: Mwtcmi Frogman

Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days.

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

Affected products

• Mwtcmi Frogman: before 1.6.2 (fixed in 1.6.2)

Published 2026-07-16. Last modified 2026-07-18.