Impact Analysis

This vulnerability allows remote attackers with valid credentials to execute arbitrary commands on the FreePBX host system.

Such exploitation can lead to severe impacts on the confidentiality, integrity, and availability of the FreePBX server.

• Remote code execution as the asterisk user
• Potential full system compromise
• Loss or unauthorized access to sensitive data
• Disruption of telephony services managed by FreePBX

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-28209 is an authenticated command injection vulnerability in FreePBX's Text-to-Speech (TTS) integration with the ElevenLabs engine, specifically within the recordings module."}, {'type': 'paragraph', 'content': 'It affects FreePBX versions 16.0.17.2 through 16.0.19.x and 17.0.2.4 through 17.0.4.x, and has been patched in versions 16.0.20 and 17.0.5.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because user-controlled input is passed unsanitized to a shell command executed via PHP’s exec() function, allowing authenticated attackers to perform remote code execution (RCE) on the FreePBX server.'}, {'type': 'paragraph', 'content': 'Exploitation requires authentication with a known username and a configured ElevenLabs API key, and is triggered through an AJAX endpoint in the System Recordings module.'}, {'type': 'paragraph', 'content': 'Successful exploitation allows arbitrary shell command execution as the asterisk user, potentially leading to full system compromise.'}] [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is an authenticated command injection in the FreePBX recordings module when using the ElevenLabs Text-to-Speech engine. Detection involves verifying if your FreePBX installation is running a vulnerable version (16.0.17.2 to before 16.0.20 or 17.0.2.4 to before 17.0.5) and if the ElevenLabs TTS integration is enabled.

Since exploitation requires authentication and access to the recordings module, monitoring access logs for suspicious authenticated AJAX requests to the recordings module endpoints may help detect attempts.

No specific detection commands are provided in the resources, but you can check your FreePBX version with commands like:

• fwconsole --version
• rpm -qa | grep freepbx

Additionally, reviewing web server logs for unusual POST requests to the recordings module AJAX endpoints or unexpected command execution traces may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the FreePBX recordings module to the patched versions 16.0.20 or 17.0.5 or later, which contain the fix for this command injection vulnerability.

Additionally, restrict access to the FreePBX Administration Control Panel (ACP) by using FreePBX User Management, SysAdmin VPN, Multi-Factor Authentication (MFA), SAML modules, and the FreePBX Firewall module to block unauthorized or hostile network access.

These measures reduce the risk of exploitation by limiting who can authenticate and access the vulnerable recordings module.

Useful 0 Not Useful 0