Disclosure summary
The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.
Source-reported weakness categories
CWE-89
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-67736
Open original source · Updated Oct 07, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| sangoma | freepbx | * {"versionStartIncluding":"17.0","versionEndExcluding":"17.0.5"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Vendor Advisory
- www.freepbx.org — Vendor Advisory
PUBLISHED 2025-12-15T20:15:52-05:00
MODIFIED 2026-10-07T15:10:00-04:00
INGESTED 2026-10-08T12:35:47-04:00