CVE-2026-67608High· 7.2▾ Twilight

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system comman…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.5 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 3, 2026

Updated

Sep 9, 2026

CVSS

7.2

Vendor

—

Product

—

CWE

CWE-78

Depth score

40 · Moderate

EPSS

2.4% · p84

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 9.

1.5% → 2.4%▲ 0.9%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 53 days

Aug 3, 2026Published
Disclosed via NVD
Sep 9, 2026Record revised
Last analysed / modified upstream
Sep 9, 2026EPSS first tracked
1.5%
Sep 25, 2026EPSS peak
1.5% → 2.4%

CWE-78 #nvd

Full technical detail▾

Overview

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed