Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73660FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

High 7.5

In plain English

A high-severity OS command injection in tts from FreePBX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.8%top 44.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

Affected products (as reported)

Vendor	Product	Versions
FreePBX	tts	< 16.0.6>= 17.0.1, < 17.0.5.4

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9 x_refsource_CONFIRM
https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0 x_refsource_MISC
https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21 x_refsource_MISC