CVE-2026-73660

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9
https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0
https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21

Configurations

No configuration.

History

24 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) FreePBX es una PBX IP de código abierto. Antes de 16.0.6 y 17.0.5.4, el módulo de Texto a Voz de FreePBX permite a un administrador autenticado guardar un nombre de destino TTS que está codificado en HTML para almacenamiento, decodificado durante la generación del dialplan, pasado como un argumento AGI y utilizado para construir nombres de archivo dentro de agi-bin/propolys-tts.agi. El nombre de destino TTS alcanza una ruta de ejecución de comandos de shell sin procesar, permitiendo la ejecución arbitraria de comandos del sistema operativo como el usuario de servicio asterisk. Este problema está corregido en las versiones 16.0.6 y 17.0.5.4.

Information

Published : 2026-08-13 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73660

Mitre link : CVE-2026-73660

CVE.ORG link : CVE-2026-73660

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-73660", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73660", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T01:40:23.901222Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreePBX", "product": "tts", "versions": [{"status": "affected", "version": "< 16.0.6"}, {"status": "affected", "version": ">= 17.0.1, < 17.0.5.4"}]}]}], "published": "2026-08-13T22:17:27.480", "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9", "source": "security-advisories@github.com"}, {"url": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0", "source": "security-advisories@github.com"}, {"url": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4."}, {"lang": "es", "value": "FreePBX es una PBX IP de c\u00f3digo abierto. Antes de 16.0.6 y 17.0.5.4, el m\u00f3dulo de Texto a Voz de FreePBX permite a un administrador autenticado guardar un nombre de destino TTS que est\u00e1 codificado en HTML para almacenamiento, decodificado durante la generaci\u00f3n del dialplan, pasado como un argumento AGI y utilizado para construir nombres de archivo dentro de agi-bin/propolys-tts.agi. El nombre de destino TTS alcanza una ruta de ejecuci\u00f3n de comandos de shell sin procesar, permitiendo la ejecuci\u00f3n arbitraria de comandos del sistema operativo como el usuario de servicio asterisk. Este problema est\u00e1 corregido en las versiones 16.0.6 y 17.0.5.4."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}