CVE-2026-73660

{
  "id": "CVE-2026-73660",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-13T22:17:27.480",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4."
    },
    {
      "lang": "es",
      "value": "FreePBX es una PBX IP de código abierto. Antes de 16.0.6 y 17.0.5.4, el módulo de Texto a Voz de FreePBX permite a un administrador autenticado guardar un nombre de destino TTS que está codificado en HTML para almacenamiento, decodificado durante la generación del dialplan, pasado como un argumento AGI y utilizado para construir nombres de archivo dentro de agi-bin/propolys-tts.agi. El nombre de destino TTS alcanza una ruta de ejecución de comandos de shell sin procesar, permitiendo la ejecución arbitraria de comandos del sistema operativo como el usuario de servicio asterisk. Este problema está corregido en las versiones 16.0.6 y 17.0.5.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FreePBX",
          "product": "tts",
          "versions": [
            {
              "version": "< 16.0.6",
              "status": "affected"
            },
            {
              "version": ">= 17.0.1, < 17.0.5.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T01:40:23.901222Z",
          "id": "CVE-2026-73660",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-hg3v-m857-mvw9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/FreePBX/tts/commit/37cf0dd3e9ceb4a32e09a2fca6a145320245c0a0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/FreePBX/tts/commit/4057410439e66d8be2b47c6358de5fab498bbc21",
      "source": "[email protected]"
    }
  ]
}