Multiple RCE's in Gammu SMS Daemon for Drupal
About the product:
Homepage: https://www.drupal.org/project/gammu_smsd
Source repository: https://git.drupalcode.org/project/gammu_smsd
Package: composer:drupal/gammu_smsd
Drupal Gammu SMS Daemon is intended to allow a Drupal site to integrate with the Gammu SMS Daemon (smsd) for the sending and receiving of SMS messages.
The program provides: * A web UI for administrates to view/send messages. * A REST API endpoint protected by an administrator chosen token. * A PHP API for use be other applications.
Vulnerability info
When the program is configured to use the Gammu CLI binaries for the sending of messages the program does not sanitize inputs resulting in an injection to executed commands through the SMS destination number and message body fields.
While there are multiple access paths (web UI and REST endpoint) the common location of the flaw is located in GammuSendSMS::sendSms(). None of the execution paths provide filtering of the calling this method.
$gammu_textdecoded = str_replace(['"', "\r\n", "\n"], ["'", " ", " "], trim($gammu_textdecoded));
$gammu_textdecoded_split = str_split($gammu_textdecoded, 153);
$count = count($gammu_textdecoded_split);
// Send sms with command line.
if ($this->config->get('gammu_cli')) {
$gammu_textdecoded = '"' . $gammu_textdecoded . '"';
if ($count == 1) {
$cmd = "gammu sendsms TEXT {$gammu_destinationnumber} -text {$gammu_textdecoded}";
return shell_exec($cmd);
}
else {
$gammu_textdecoded = '"' . $gammu_textdecoded . '"';
$cmd = "gammu-smsd-inject -c smsdrc TEXT {$gammu_destinationnumber} -unicode -len 400 -text {$gammu_textdecoded}";
return shell_exec($cmd);
}
}
The variable $gammu_textdecoded is the only filtered variable having dobule quotes " converted to single quotes ' and the contents later enclosed in double quotes. The translation of double quotes prevents a direct escape to shell, however leaves open of inline executions suchs as the backtick operator. and thus limits the attack service to inline executions, such as with backticks or $(command) shell execution.
The $gammu_destinationnumber variable directly passed to the shell with no escaping. A simple command end ; attack is sufficient, all other tradtional shell execution vectors remain avaliable.
An example POC through the REST endpoint located at api/gammu/send
curl -X POST https://example.org/api/gammu/send \
-H "Authorization: <ACCESS_TOKEN>" \
-H "Content-Type: application/json" \
-d '{ "number":"echo \'RCE Success\' > vulnerable_number_field.txt", "text":"`touch vulnerable_text_field.txt`" }'
A POC formated as a Drupal PHPUnit test is available on Github.
Attack requirements
- The configuration option
Use Gammu CLImust be enabled - An attacker must one of the following authentication/authorization conditions:
- An account with the permission
administer gammu - The REST API token configured at
admin/config/services/gammu-smsd
Impacted versions
All current published and unpublished releases are believed to be vulnerable (<= 8.x-1.3).
CVE score
CVSS v4.0 Base Score: 9.0 / Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Related CWE's
Additional information
Tested against 8.x-1.2.
The initial report only demonstrated the exploit through the Web UI. REST API shares same code execution path and is considered and included caller with respect to initial report.
The maintainer of the product was contacted through their published vulnerability reporting service. At time of issue opening they were provided the following coordinated disclosure timeline notice
This report is subject to a 90 day disclosure policy. If a fix for this report is made available to users before the end of the 90-day timeline, this report report will become public 30 days after the fix was made available. If no fix is made available this report will become public at the 90 day mark. The timeline may be shortened in response to an increase in public risk.
The report was initially opened with only the destination phone number field vulnerability being present in the report. Additional review and testing of the code of the code uncovered the inline command execution risk of the message field and this was included in a latter message of the same report.
While the report was considered eligible for early release, publication was withheld due to an additional vulnerability that could increase the risk having not yet exited embargo status.
Low reported public was taken into consideration in publication timeline decisions.
Timeline
17/05/2026-1
Report submitted to project through their registered vulnerability reporting service. Report automatically acknowledged by reporting service.
17/05/2026-2
Project maintainer commented that they did not see the risk.
17/05/2026-3
Maintainer Was informed that a user with a low level permission would be able to "execute random code on the server hosting Drupal including but not limited to code that may modify critical files on the server, disclose database or other secret data, potentially allow a Local Privileged Escalation(LPE) attack to gain full server access".
18/05/2026-1
Observed that project owner had publicly commited an issue into the source repo "Check role for gammu cli execute" f1c737 that added a permissions check and added basic filtering to the number field. Inquiry made regarding if maintainer considered this a fix for flaw.
18/05/2026-2
Maintainer advised they did not consider f1c737 a fix.
19/06/2026-1
Inquiry made regarding an update on fix timeline. Noted that previous commit was considered close to disclosing RCE to public. Maintainer informed that the message field was also at risk of exploit.
20/06/2026-1
Maintainer advised they believed they had a fix for the flaw. Maintainer marked issue as completed.
20/06/2026-2
Acknowledged observing public commit disclosing RCE presence 4e65d1. Advised would review "next day".
20/06/2026-3
Advised maintainer commit message "RCE when configured to use CLI for message sending" appeared to publicly disclose the vulnerability. Advised maintainer that created fix appear to still have bypass options available. Advised that vulnerability report was now considered "publicly disclosed with an incomplete fix available" and requested update how maintainer intended to remedy.
20/06/2026-4
Reporting service re-opened issue and provided process directions to maintainer.
07/07/2026-1
Advised the reporting service and maintainer that report was now considered eligible for immediate publication under the increased public risk condition. Asked reporting service if they had a date they would like to disclose on.
07/07/2026-2
Reporting service confirmed the appearance of a vulnerability still present based on thread comments. No date for next step provided.
06/08/2026
Reporting service marked report Project to be unsupported.
16/08/2026
Report disclosed by reporter.