FreePBX: Unsecured Code Execution via ElevenLabs TTS Engine

Summary

FreePBX, an open source phone system software, has a security issue that could allow attackers to execute unauthorized commands. This affects versions 16.0.17.2 to 16.0.20 and 17.0.2.4 to 17.0.5. Update to version 16.0.20 or 17.0.5 to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
sangoma	freepbx	> 16.0.17.2 , <= 16.0.20	–
sangoma	freepbx	> 17.0.2.4 , <= 17.0.5	–

Original title

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs...

Original description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

nvd CVSS3.1 7.2

nvd CVSS4.0 7.5

Vulnerability type

CWE-78 OS Command Injection

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87... Mitigation Vendor Advisory