CVE-2026-73660 in FreePBX
Summary
by MITRE • 08/13/2026
FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical command injection flaw within the FreePBX Text-To-Speech module that affects versions prior to 16.0.6 and 17.0.5.4. This issue stems from improper input validation and sanitization within the text-to-speech functionality, creating a dangerous path for privilege escalation and arbitrary code execution. The vulnerability operates through a complex chain of processing steps where user-supplied data flows from initial input through multiple layers of encoding and decoding before reaching a shell command execution context.
The technical flaw manifests in how the TTS destination name is handled throughout the application lifecycle. When an authenticated administrator creates a TTS destination, the system HTML-encodes the destination name for safe storage within the database. However, during dialplan generation, this encoded data undergoes decoding and becomes part of an AGI argument that gets passed to the agi-bin/propolys-tts.agi script. This particular script constructs filenames using the decoded TTS destination name without proper sanitization, ultimately passing this unvalidated input into shell command execution contexts. The vulnerability is classified as a command injection issue under CWE-78, which specifically addresses improper neutralization of special elements used in OS commands.
The operational impact of this vulnerability is severe as it allows authenticated administrators to execute arbitrary operating system commands with the privileges of the asterisk service user, which typically runs with elevated permissions. This creates a significant attack surface where an attacker could potentially gain full control over the PBX server, access sensitive communications data, modify system configurations, or establish persistent backdoors. The attack vector requires only administrative access, making it particularly dangerous in environments where administrative privileges are shared among multiple users.
This vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell and T1059.004 for Command and Scripting Interpreter: Unix Shell, as the exploitation involves executing shell commands through legitimate system interfaces. The issue demonstrates poor input validation practices that violate security best practices outlined in OWASP Top 10 and NIST SP 800-53, particularly concerning the proper sanitization of user inputs before they reach execution contexts.
The fix implemented in versions 16.0.6 and 17.0.5.4 addresses this vulnerability through proper input validation and sanitization mechanisms that prevent malicious payloads from being passed to shell command execution points. Organizations should immediately upgrade to these patched versions or implement compensating controls such as network segmentation, privileged access management, and monitoring of suspicious shell command executions. Additionally, the incident highlights the importance of validating all user inputs at multiple stages within application processing pipelines, particularly when data flows through encoding/decoding operations that could potentially bypass security controls.