Home

Description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

PUBLISHED Reserved 2026-02-25 | Published 2026-03-05 | Updated 2026-03-07 | Assigner GitHub_M




HIGH: 7.5CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

>= 16.0.17.2, < 16.0.20
affected

>= 17.0.2.4, < 17.0.5
affected

References

github.com/...orting/security/advisories/GHSA-f558-mp87-58vj

cve.org (CVE-2026-28209)

nvd.nist.gov (CVE-2026-28209)

Download JSON