CVE-2026-73660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73660", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-13T14:04:09.605Z", "datePublished": "2026-08-13T21:23:01.070Z", "dateUpdated": "2026-08-18T01:40:32.517Z"}, "containers": {"cna": {"title": "FreePBX: Authenticated TTS AGI Command Injection Through TTS Name", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9"}, {"name": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0", "tags": ["x_refsource_MISC"], "url": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0"}, {"name": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21", "tags": ["x_refsource_MISC"], "url": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21"}], "affected": [{"vendor": "FreePBX", "product": "tts", "versions": [{"version": "< 16.0.6", "status": "affected"}, {"version": ">= 17.0.1, < 17.0.5.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T21:28:30.500Z"}, "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4."}], "source": {"advisory": "GHSA-hg3v-m857-mvw9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T01:40:23.901222Z", "id": "CVE-2026-73660", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T01:40:32.517Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T01:40:23.901222Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T01:40:28.359Z"}}], "cna": {"title": "FreePBX: Authenticated TTS AGI Command Injection Through TTS Name", "source": {"advisory": "GHSA-hg3v-m857-mvw9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FreePBX", "product": "tts", "versions": [{"status": "affected", "version": "< 16.0.6"}, {"status": "affected", "version": ">= 17.0.1, < 17.0.5.4"}]}], "references": [{"url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9", "name": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0", "name": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21", "name": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T21:28:30.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73660", "state": "PUBLISHED", "dateUpdated": "2026-08-18T01:40:32.517Z", "dateReserved": "2026-08-13T14:04:09.605Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T21:23:01.070Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tts", "vendor": "FreePBX", "versions": [{"status": "affected", "version": "< 16.0.6"}, {"status": "affected", "version": ">= 17.0.1, < 17.0.5.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4."}, {"lang": "es", "value": "FreePBX es una PBX IP de c\u00f3digo abierto. Antes de 16.0.6 y 17.0.5.4, el m\u00f3dulo de Texto a Voz de FreePBX permite a un administrador autenticado guardar un nombre de destino TTS que est\u00e1 codificado en HTML para almacenamiento, decodificado durante la generaci\u00f3n del dialplan, pasado como un argumento AGI y utilizado para construir nombres de archivo dentro de agi-bin/propolys-tts.agi. El nombre de destino TTS alcanza una ruta de ejecuci\u00f3n de comandos de shell sin procesar, permitiendo la ejecuci\u00f3n arbitraria de comandos del sistema operativo como el usuario de servicio asterisk. Este problema est\u00e1 corregido en las versiones 16.0.6 y 17.0.5.4."}], "id": "CVE-2026-73660", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73660", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T01:40:23.901222Z", "version": "2.0.3"}}]}, "published": "2026-08-13T22:17:27.480", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9"}, {"source": "security-advisories@github.com", "url": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0"}, {"source": "security-advisories@github.com", "url": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.1,17.0.5.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tts", "source": "cna", "vendor": "FreePBX"}, "product": "tts", "vendor": "freepbx"}], "created": "2026-08-13T22:45:03.553076+00:00", "updated": "2026-08-14T09:30:23.785578+00:00", "vendors": ["freepbx", "freepbx$PRODUCT$tts"]}