CVE-2026-28209 — FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

CVE-2026-28209

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration PUBLISHED

Description (CNA)

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

Affected (CNA)

Vendor / product	Versions
FreePBX / security-reporting	affected >= 16.0.17.2, < 16.0.20; affected >= 17.0.2.4, < 17.0.5

CWE

CWE-78

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.