Vulnerability details

CVE-2026-73660

FreePBX tts

FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

CVSS 4.0

7.5High

Official description

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

CVSS scores

Score	Version	Source	Vector
7.5High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
FreePBX	tts	< 16.0.6	CVEProject cvelistV5 (CNA)
FreePBX	tts	>= 17.0.1, < 17.0.5.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9 x_refsource_CONFIRM
https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0 x_refsource_MISC
https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-14
Last updated: 2026-08-18
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.77%

Probability of exploitation in 30 days

55.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')