CVE-2026-46516 Overview
CVE-2026-46516 is a stored cross-site scripting (XSS) vulnerability in Frogman, a headless FreePBX control interface. The flaw affects versions prior to 1.6.6. The formatMarkdown function in assets/js/chat.js inserts regex capture groups as raw HTML across four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled FreePBX fields — extension names, ring-group descriptions, IVR names, and queue descriptions — can carry HTML or JavaScript payloads. The payload executes in the browser session of any administrator who views the response through Frogman chat, running with that viewer's permissions. Version 1.6.6 patches the issue.
Critical Impact
An attacker with permission to edit FreePBX object fields can inject JavaScript that executes when another administrator views the Frogman chat response, allowing session-context actions in the viewer's browser.
Affected Products
- Frogman versions prior to 1.6.6
- Frogman assets/js/chat.js markdown formatter component
- FreePBX environments managed through Frogman chat console
Discovery Timeline
- 2026-07-20 - CVE-2026-46516 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-46516
Vulnerability Analysis
The vulnerability is a stored XSS [CWE-79] in the Frogman chat console's client-side markdown renderer. Frogman surfaces FreePBX object data — extensions, ring groups, IVRs, and queues — inside chat responses formatted by the formatMarkdown routine in assets/js/chat.js. That routine substitutes regex capture groups directly into HTML for four templates: inline code, bold, markdown links, and download links.
Because the captured content is not escaped before insertion, any HTML or JavaScript embedded in a reflected field renders as active markup. FreePBX's own admin GUI applies freepbx_htmlspecialchars() when displaying these same fields, so the underlying data store is trusted to hold arbitrary characters. The chat formatter breaks that contract.
Exploitation requires high privileges to write the source field and user interaction from a second administrator to trigger the payload. The impact is limited to the viewer's session scope, but that session typically holds FreePBX administrative rights.
Root Cause
The root cause is missing output encoding in a client-side template renderer. The formatMarkdown function treats regex capture groups as safe HTML fragments rather than untrusted strings. Escaping the captured content before concatenation would neutralize the payload.
Attack Vector
An authenticated attacker with rights to edit FreePBX object metadata sets a field value containing an HTML or JavaScript payload — for example, an extension name or IVR description. When a Frogman administrator issues a chat command that lists or references that object, the tool response reflects the field. The client-side formatter renders the payload as live HTML in the viewer's browser, executing script under the viewer's session.
Refer to the GitHub Security Advisory and the patch commit for technical detail on the affected patterns and the fix.
Detection Methods for CVE-2026-46516
Indicators of Compromise
- FreePBX object fields (extension names, ring-group descriptions, IVR names, queue descriptions) containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs.
- Frogman chat response payloads that contain unescaped angle brackets or event-handler attributes inside inline code, bold, or link markdown patterns.
- Unexpected outbound HTTP requests from administrator browsers after viewing Frogman chat sessions.
Detection Strategies
- Audit FreePBX configuration exports for HTML metacharacters (<, >, ", ', backticks) in name and description fields.
- Review Frogman chat transcripts and server logs for tool responses that include raw HTML tags reflected from FreePBX object data.
- Compare deployed Frogman version against 1.6.6; any earlier build is vulnerable regardless of configuration.
Monitoring Recommendations
- Log administrator activity in FreePBX that modifies object names and descriptions, and correlate with subsequent Frogman chat views.
- Deploy browser-side Content Security Policy (CSP) reporting to capture inline script execution attempts on the Frogman chat interface.
- Alert on Frogman chat sessions initiated by administrators immediately after low-privilege edits to FreePBX metadata.
How to Mitigate CVE-2026-46516
Immediate Actions Required
- Upgrade Frogman to version 1.6.6 or later on all hosts running the chat console.
- Restrict who can edit FreePBX object fields that surface in Frogman responses until the upgrade is complete.
- Review existing FreePBX object metadata for embedded HTML or JavaScript and sanitize any suspicious entries.
Patch Information
Version 1.6.6 patches the flaw by escaping capture-group content before it is inserted into the four markdown template patterns. See the fix in the Frogman patch commit.
Workarounds
- Limit Frogman chat console access to a small set of trusted administrators until the patch is deployed.
- Enforce a strict CSP on the Frogman web interface that blocks inline scripts and unauthorized script sources.
- Manually sanitize FreePBX field values by removing HTML metacharacters through a scripted audit of the configuration database.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
