The vulnerability exists in earlier releases of the FreePBX Text‑To‑Speech module. An authenticated administrator can upload a destination name that contains HTML‑encoded characters. During dialplan generation the name is decoded, appended to an AGI argument, and used to construct a filename inside the agi-bin/propolys‑tts.AGI script, which ultimately is passed to the operating‑system shell. Consequently, a crafted name can inject arbitrary shell commands that run as the asterisk service account, allowing remote code execution. The weakness is a classic command‑injection scenario, reflected in CWE‑78.

This flaw affects installations of FreePBX that use the TTS module in versions earlier than 16.0.6 or 17.0.5.4. The solution is to upgrade to at least those patch levels, as they modify the handling of the destination name to prevent the injection. All other versions are considered unpatched and therefore susceptible.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so the probability of exploitation cannot be quantified. Because the flaw requires authenticated administrator access, the attack vector is likely limited to compromised or stolen credentials, or an insider threat. The flaw is not listed in the CISA KEV catalog, but its potential for OS command execution on the Asterisk service user suggests an immediate need to patch. An attacker who succeeds can run arbitrary commands, compromising the host or enabling lateral movement within the network.