What’s Vulnerable › Vulnerabilities
CVE-2026-28209: FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-05 · updated 2026-06-17
- Weakness: CWE-78
Description
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Affected products
- Sangoma FreePBX: from 16.0.17.2 before 16.0.20; from 17.0.2.4 before 17.0.5 — fixed in 16.0.20, 17.0.5
How to fix
Upgrade to a fixed version: Sangoma FreePBX 16.0.20, 17.0.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-28209 or the next vulnerability affects your stack