Answer in brief
CVE-2026-46512 records a Critical severity (CVSS 9.9) vulnerability in Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping. The current sources do not mark it as known exploited. The current feed maps mwtcmi/frogman (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps mwtcmi/frogman (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| mwtcmi/frogmangeneric | < 1.6.2 | Not reported |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 16, 2026
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-46512 records a Critical severity (CVSS 9.9) vulnerability in Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping. The current sources do not mark it as known exploited. The current feed maps mwtcmi/frogman (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps mwtcmi/frogman (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| mwtcmi/frogmangeneric | < 1.6.2 | Not reported |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 16, 2026
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.
Quoted source text, attributed separately from HOL analysis.