CVE-2026-73660

Received Received - Intake

Command Injection in FreePBX Text-To-Speech Module

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73660

Affected Vendors & Products

Vendor	Product	Version / Range
freepbx	freepbx	to 16.0.6\|end_excluding=17.0.5.4 (exc)
freepbx	text_to_speech	to 16.0.6\|end_excluding=17.0.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in FreePBX's Text-To-Speech module allows an authenticated administrator to inject HTML-encoded text that gets decoded and executed as a shell command. The command runs with the privileges of the asterisk service user, enabling arbitrary OS command execution.

Impact Analysis

An attacker with admin access could execute malicious commands on the server, potentially leading to data theft, system compromise, or disruption of phone services. The impact depends on the server's configuration and network access.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Non-compliance risks fines and legal consequences.

Mitigation Strategies

Update FreePBX to version 16.0.6 or 17.0.5.4 or later to fix the vulnerability. If immediate update is not possible, restrict access to the FreePBX admin interface and disable the Text-To-Speech module until patched.

Hi! I’m here to help you understand CVE-2026-73660. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70