CVE-2026-73660

HIGH

FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-73660 has a selected CVSS score of 7.5 (high).

Description

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

Description source: CVE List

Affected products and versions

1
ProductSourceVersion range

tts

Browse FreePBX / tts
CVE List< 16.0.6affected
>= 17.0.1, < 17.0.5.4affected

References

3