CVE-2025-67736

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

High8.6EPSS 6.4%

Published: 16 Dec 2025
Updated: 3 Nov 2026
Reserved: 11 Dec 2025
Assigned by: GitHub_M

Description

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.

Timeline

2025
11 Dec 2025
11 Dec 2025
ID reserved
By GitHub_M
16 Dec 20255 days later
16 Dec 2025· 5 days later
Published
2026
3 Nov 202611 months later
3 Nov 2026· 11 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-67736, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 6.4% · top 6.2% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

FreePBX · tts
- affected < 16.0.5
- affected >= 17.0.0, < 17.0.5

References (2)

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-632c-49p9-x7cw (opens in a new tab)x_refsource_CONFIRM
https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-67736](https://trackcve.app/badge/CVE-2025-67736.svg)](https://trackcve.app/cve/CVE-2025-67736)

Record last updated 3 Nov 2026, 22:03 UTC.