CVE-2026-28209 Details
Description
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
A command injection vulnerability allowing remote code execution has been identified in FreePBX versions 16.0.17.2 prior to 16.0.20 and 17.0.2.4 prior to 17.0.5. The issue arises in the recordings module when the ElevenLabs Text-to-Speech engine is used. User-controlled input is passed unsanitized to a shell command executed via 'exec()', enabling authenticated attackers to execute arbitrary commands on the FreePBX server. This vulnerability affects users with access to the recordings functionality through an AJAX endpoint in the System Recordings module.
Users can update the recordings module to the latest version. It is also recommended to ensure that only authorized users have access to the FreePBX Administration Control Panel, and to deny access from hostile networks using the FreePBX Firewall module.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sangoma freepbx | >= 16.0.17.2, < 16.0.20 >= 17.0.2.4, < 17.0.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 6, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | New CVE Received | [email protected] |