Executive brief
FreePBX is an open-source IP PBX system used to manage voice communications and phone calls. The Text-To-Speech module contains a vulnerability that allows an authenticated administrator to execute arbitrary operating system commands on the server, potentially compromising the entire phone system and any data it handles. This could lead to unauthorized access to call recordings, customer data, and disruption of business communications.
Technical details
The vulnerability is a command injection flaw in the FreePBX Text-To-Speech (TTS) module. A TTS destination name is HTML-encoded for storage, then decoded during dialplan generation, passed as an AGI argument, and used to build filenames in the propolys-tts.agi script. Insufficient sanitization allows an authenticated administrator to inject shell metacharacters into the TTS name, which are executed by the asterisk service user when the AGI script processes the filename. Attack requires valid FreePBX administrator credentials and network access to the administration panel. An attacker can achieve arbitrary OS command execution with asterisk service privileges. The vulnerability has been patched in FreePBX versions 16.0.6 and 17.0.6.
Affected products
- FreePBX FreePBX prior to 16.0.6 and prior to 17.0.5.4
Timeline
- 2026-07-16: disclosed
- 2026: patched: Patched in versions 16.0.6 and 17.0.5.4