Vulnerability · Published Dec 16, 2025 · Assigned by GitHub_M

CVE-2025-67736Authenticated SQL Injection in FreePBX tts (Text To Speech) module

High 8.6

In plain English

A high-severity SQL injection in tts from FreePBX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.4% (higher than 94% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)6.4%top 6.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.

Affected products (as reported)

Vendor	Product	Versions
FreePBX	tts	< 16.0.5>= 17.0.0, < 17.0.5

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-632c-49p9-x7cw x_refsource_CONFIRM
https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80 x_refsource_MISC