Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28209 Command Injection Vulnerability in FreePBX ElevenLabs Text-to-Speech Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28209
Post summary
A new command injection vulnerability (CVE-2026-28209) affecting the FreePBX ElevenLabs Text‑to‑Speech module has been identified, with no PoC, exploit, or patch information provided.
CVE-2026-28209 FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in Fr… https://www.cve.org/CVERecord?id=CVE-2026-28209
Post summary
CVE-2026-28209 is a command‑injection vulnerability disclosed for specific FreePBX versions, with no details on exploits, active use, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sangoma | freepbx | - | - | - |