7.5Alta
CVE-2026-28209FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
Descripción
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| FreePBX | security-reporting | >= 16.0.17.2, < 16.0.20, >= 17.0.2.4, < 17.0.5 | |
| sangoma | freepbx | 16.0.17.2 – < 16.0.20 |
Referencias y parches
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj MitigationVendor Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*≥ 16.0.17.2 < 16.0.20cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*≥ 17.0.2.4 < 17.0.5