CVE-2026-45562: FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. The root cause lies in the fact that the module accepts a POST parameter that defines a custom Asterisk application, which is then stored in the database without any sanitization. Later, this data is written directly to the musiconholdadditional.conf configuration file without validation. Since Asterisk reads this configuration file and executes the specified application, an attacker can inject arbitrary commands that will be executed with Asterisk's permissions. This issue has been patched in versions 16.0.4 and 17.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX Music on Hold (MoH) moduleto a version that resolves this vulnerability.Fixed in 16.0.4 - Upgrade
Upgrade
FreePBX Music on Hold (MoH) moduleto a version that resolves this vulnerability.Fixed in 17.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an existing FreePBX administrator account. Successful exploitation allows commands to run with the privileges of the Asterisk service.
Which versions contain the fix?
The issue is patched in FreePBX versions 16.0.4 and 17.0.6. Versions prior to those releases are affected.
What component and workflow are involved in exploitation?
The vulnerable component is the FreePBX Music on Hold module. An authenticated administrator can submit a custom Asterisk application through a POST parameter; the value is stored and later written into musiconhold_additional.conf, where Asterisk executes it.