CVE-2026-57203
Severity not reportedAsterisk is an open source private branch exchange and telephony toolkit.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/asterisk/asterisk/commit/022407ec47adebe27b7ec8bcf5626e5a02fe1551 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/a51c4e3d6bccce4bc4226c43e78952573a62f165 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/ba8e5bdecd5280fc0ab230df59e41ea21b3a052f security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/bd63fe121d0e86867863bd98b5771e592273b035 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/c0fc2ae54cb6289a48a80333432f5fdf5a40c7de security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/f18ac4c964781f671e400342790bf40679698067 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 security-advisories@github.com
- https://github.com/asterisk/asterisk/security/advisories/GHSA-xgj6-2gc5-5x9c security-advisories@github.com
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 security-advisories@github.com