CVE-2025-67736

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.

• CWE-89

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-632c-49p9-x7cwVendor Advisory
• https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67730Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2025-67731Servify Express is a Node.js package to start an Express ser…7.5
• CVE-2025-67732Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-67733Valkey is a distributed key-value database. Prior to version…7.1
• CVE-2025-67734Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2025-67735Netty is an asynchronous, event-driven network application f…6.5
• CVE-2025-67737AzuraCast is a self-hosted, all-in-one web radio management …3.7
• CVE-2025-67738squid/cachemgr.cgi in Webmin before 2.600 does not properly …8.5
• CVE-2025-67739In JetBrains TeamCity before 2025.11.2 improper repository U…3.1
• CVE-2025-6774A vulnerability was found in gooaclok819 sublinkX up to 1.8.…6.3
• CVE-2025-67740In JetBrains TeamCity before 2025.11 improper access control…5.3
• CVE-2025-67741In JetBrains TeamCity before 2025.11 stored XSS was possible…5.4