CVE-2026-73662

Received Received - Intake

Authenticated Command Execution in FreePBX Music on Hold Module

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73662

Affected Vendors & Products

Vendor	Product	Version / Range
freepbx	music_on_hold	to 17.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

FreePBX versions 17.0.1 to 17.0.7 contain a flaw in the Music on Hold module. An authenticated administrator can exploit dangerous command-line options in the module's configuration to execute arbitrary commands as the asterisk service user. The issue arises because the module fails to reject options that allow writing files, opening control channels, or creating Asterisk call files.

Detection Guidance

Check FreePBX Music on Hold module version between 17.0.1 and 17.0.7. Inspect Music.class.php for improper validation of player options. Look for unauthorized file writes or Asterisk call file creation by the asterisk user.

Impact Analysis

An attacker with administrative access could execute arbitrary commands on the system running FreePBX. This could lead to unauthorized file access, system compromise, or disruption of PBX services. The impact is limited to systems running vulnerable versions of FreePBX.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and access controls. Organizations using vulnerable FreePBX versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade FreePBX Music on Hold module to version 17.0.7 or later. Remove or restrict admin access to the module configuration until patched. Monitor system logs for suspicious activity from the asterisk user.

Hi! I’m here to help you understand CVE-2026-73662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70