CVE-2026-73660: FreePBX: Authenticated TTS AGI Command Injection Through TTS Name
FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX Text-To-Speech moduleto a version that resolves this vulnerability.Fixed in 16.0.6 - Upgrade
Upgrade
FreePBX Text-To-Speech moduleto a version that resolves this vulnerability.Fixed in 17.0.5.4
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-73660?
CVE-2026-73660 has a risk level of 62.
How does CVE-2026-73660 affect FreePBX?
CVE-2026-73660 allows authenticated administrators to perform command injection through the Text-To-Speech module by manipulating TTS destination names.
What versions of FreePBX are vulnerable to CVE-2026-73660?
CVE-2026-73660 affects FreePBX versions prior to 16.0.6 and 17.0.5.4.
How can I mitigate CVE-2026-73660?
To mitigate CVE-2026-73660, upgrade FreePBX to versions 16.0.6 or 17.0.5.4 or later.
What type of vulnerability is CVE-2026-73660 classified as?
CVE-2026-73660 is classified as an OS Command Injection vulnerability.