EUVD-2026-58483Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required for exploitation (PR:H); admin panel is network-accessible (AV:N); execution stays within the asterisk service user boundary with no scope change (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.
AnalysisAI
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active FreePBX administrator session - the attacker must authenticate to the FreePBX web panel with an account holding administrator-level privileges; lower-privileged FreePBX user roles that cannot modify TTS destination configurations are not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.5 with vector AV:N/AC:L/AT:P/PR:H reflects the tension between high impact and a meaningful authentication barrier: exploitation requires a fully authenticated FreePBX administrator account, which is a non-trivial prerequisite that substantially limits opportunistic and mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained FreePBX administrator credentials - via credential stuffing against an internet-exposed admin panel, phishing, or lateral movement from a previously compromised host - logs into the FreePBX web interface, navigates to the TTS module configuration, and saves a destination name embedding a shell payload such as a semicolon-delimited reverse shell command. When dialplan generation is triggered on save or reload, the destination name is HTML-decoded and passed without escaping into an exec() call in propolys-tts.agi, executing the injected command as the asterisk operating-system user. … |
| Remediation | Upgrade the FreePBX TTS module to version 16.0.6 (branch 16) or 17.0.5.4 (branch 17), as confirmed by the vendor security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9; the corresponding upstream fixes are in commits 37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0 and 4057410439e66d8be2b47c6358de5fab498bbc21. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all FreePBX instances running branch 16 before version 16.0.6 or branch 17 before version 17.0.5.4; review administrator accounts and access logs for unauthorized activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today