Freepbx
CVE-2026-28209
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege FreePBX admin
-
DeliveryAccess recordings module
-
ExploitConfigure ElevenLabs TTS engine
-
ExecutionInject malicious commands in TTS parameters
-
ImpactExecute arbitrary shell commands on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | FreePBX versions 16.0.17.2–16.0.19 or 17.0.2.4–17.0.4 with ElevenLabs Text-to-Speech engine enabled in recordings module. Attacker requires high-privilege administrative credentials to access and configure the TTS settings. |
| Impact | CVSS 7.2 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated command injection in FreePBX versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 via the ElevenLabs Text-to-Speech integration allows authenticated users with high privileges to execute arbitrary system commands. The vulnerability exists in the recordings module and affects all installations using the vulnerable TTS engine. No patch is currently available, leaving affected systems at risk of full system compromise.
Earlier versions of this analysis (1)
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. [CVSS 7.2 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-78 (OS Command Injection). Affects the recordings component of Freepbx. FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Know when Freepbx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Executive ViewAI
FreePBX installations versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 contain a command injection vulnerability in the ElevenLabs text-to-speech module that could allow attackers to execute arbitrary commands on affected systems. Organizations using FreePBX with this TTS integration are at risk of unauthorized system access and potential business communications disruption.
Disable ElevenLabs TTS engine in the recordings module immediately; implement network segmentation restricting FreePBX system access; deploy WAF rules blocking command injection patterns (pipe, semicolon, backtick characters in TTS input); restrict administrative access to recordings module; enable comprehensive logging and monitoring of recordings module activity; consider reverting to alternative TTS engines without known vulnerabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in FreePBX Command Injection and SQL Injection
View all 4FreePBX 15, 16, and 17 contain SQL injection vulnerabilities enabling unauthenticated access to the administrator interf
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9,
Authenticated arbitrary file upload in the FreePBX Endpoint Manager module (FreePBX 16 before 16.0.92 and FreePBX 17 bef
Authenticated SQL injection in the FreePBX Endpoint Manager module allows a user holding a valid, known FreePBX username
Authentication bypass in the FreePBX Endpoint Manager module lets remote, unauthenticated attackers impersonate any targ
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Rated
Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access contr
FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order param
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrar
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. Rated medium se
Exploit-DB