CVE-2026-46516: fallo de gravedad media en mwtcmi frogman
Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.4%
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer's session, with the viewer's permissions. FreePBX's own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
mwtcmi · frogmanCVEs relacionadas — mwtcmi frogman
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-46512CRITICALFrogman: Dialplan template parameters interpolated into extensions_custom.conf without escapingEPSS 0.7%CVE-2026-46515CRITICALFrogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL executionEPSS 0.6%CVE-2026-46514MEDIUMFrogman: Plaintext passwords and secrets persisted to audit logEPSS 0.5%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.4%