CVE-2026-116786

FreeSWITCH versions prior to 1.11.2 are vulnerable to command execution due to a channel-variable injection flaw in the mod_sofia module. The vulnerability exists because sofia_handle_sip_i_refer() inserts raw Refer-To URI parameters and headers into a sip_invite_params channel-variable block. Be...