CVE-2026-73660

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73660
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73660.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73660
Aliases
  • GHSA-hg3v-m857-mvw9
Published
2026-08-13T21:23:01.070Z
Modified
2026-08-19T03:31:07.392361748Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreePBX: Authenticated TTS AGI Command Injection Through TTS Name
Details

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73660.json",
    "cwe_ids": [
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/freepbx/tts

Affected ranges

Type
GIT
Repo
https://github.com/freepbx/tts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
34af437daf9070823609a2ed674d68753474202d
Fixed
8de28e6f71c13692d25a5ef0cf7f0f0bcec92f0c
Fixed
83bff3dc2c433dd6fdf8539728d39562b5e576b1
Fixed
37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0
Fixed
4057410439e66d8be2b47c6358de5fab498bbc21
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.0.6"
        },
        {
            "introduced": "17.0.1"
        },
        {
            "fixed": "17.0.5.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release/13.*
release/13.0.10
release/13.0.1alpha1
release/13.0.2
release/13.0.3
release/13.0.5
release/13.0.6
release/13.0.7
release/13.0.8
release/13.0.9
release/15.*
release/15.0.10
release/15.0.11
release/15.0.2
release/15.0.3
release/15.0.4
release/15.0.5
release/15.0.6
release/15.0.7
release/15.0.8
release/15.0.9
release/16.*
release/16.0.1
release/16.0.2
release/16.0.3
release/16.0.4
release/16.0.5
release/17.*
release/17.0.1
release/17.0.1.1
release/17.0.2
release/17.0.3
release/17.0.4
release/17.0.5
release/17.0.5.1
release/17.0.5.2
release/17.0.5.3
release/2.*
release/2.11.0.10
release/2.11.0.7
release/2.11.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73660.json"