A text message that runs a command: OS command injection in Gammu SMSD (GHSA-9vjj-v46c-c5qf)

TL;DR

What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every time a text arrives. With the Files backend and RunOnReceive enabled, the SMS sender ID was escaped for use as a filename but not for the shell, and then appended to a /bin/sh -c command line. A sender ID containing shell metacharacters executed arbitrary commands as the gammu-smsd user.

Impact: Remote, unauthenticated code execution triggered by sending a text message. Commands run with the daemon's privileges. Missing neutralization of special elements in an OS command (CWE-78).

Fixed in: Gammu 1.43.3. Advisory GHSA-9vjj-v46c-c5qf, published 25 July 2026, rated High (8.1), credited to me as reporter. CVE requested, pending GitHub assignment.

Why you should care