Tts
Monthly
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authenticated OS command injection in the FreePBX Text-To-Speech module allows an administrator-level attacker to execute arbitrary operating-system commands as the asterisk service user on installations running branch 16 prior to version 16.0.6 or branch 17 prior to 17.0.5.4. The root cause is unsanitized administrator-controlled input - specifically a TTS destination name - flowing through HTML decoding during dialplan generation and into multiple PHP exec() call sites inside agi-bin/propolys-tts.agi without shell escaping across all supported TTS engine backends. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.