QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-28209

Back to search

CVE-2026-28209

Published: Mar 5, 2026

Modified: Mar 7, 2026

PUBLISHED

Description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

VendorProductVersions

FreePBX

security-reporting

affected
>= 16.0.17.2, < 16.0.20
affected
>= 17.0.2.4, < 17.0.5

Weaknesses (CWE)

CWE-78

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now