CVE-2026-73662: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBXto a version that resolves this vulnerability.Fixed in 17.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73662?
The severity of CVE-2026-73662 is rated as 52, indicating a moderate risk level.
How do I fix CVE-2026-73662?
To fix CVE-2026-73662, upgrade your FreePBX system to version 17.0.8 or later.
Who is affected by CVE-2026-73662?
CVE-2026-73662 affects FreePBX versions from 17.0.1 to 17.0.7, specifically the Music on Hold module.
What type of vulnerability is CVE-2026-73662?
CVE-2026-73662 is classified as an OS Command Injection vulnerability.
Can an attacker exploit CVE-2026-73662 remotely?
Yes, an authenticated administrator can exploit CVE-2026-73662 to execute arbitrary commands.