Vulnerability details

CVE-2026-28209

FreePBX security-reporting

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

CVSS 4.0

7.5High

Official description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

CVSS scores

Score	Version	Source	Vector
7.5High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
FreePBX	security-reporting	>= 16.0.17.2, < 16.0.20	CVEProject cvelistV5 (CNA)
FreePBX	security-reporting	>= 17.0.2.4, < 17.0.5	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-05
Last updated: 2026-03-07
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

1.02%

Probability of exploitation in 30 days

63.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')