CVE-2026-73662
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.
Risk Assessment
Risk of arbitrary command execution on the system as the asterisk user, potentially leading to system and data integrity compromise.
Recommendation
Update FreePBX to version 17.0.7 or later, which includes the fix.
Original NVD description (English source)
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.