EIP-2026-107235

This exploit demonstrates an unauthenticated remote command execution vulnerability in FreePBX versions 13.0.x < 13.0.154. The vulnerability arises from weak input validation in the music module, allowing command injection via the filename parameter during file upload.