CVE-2026-73662

Name of the Vulnerable Software and Affected Versions FreePBX versions 17.0.1 through 17.0.6

Description The Music on Hold module allows dangerous command-line options for /usr/bin/mpg123 and other permitted players within the validateCustomConfiguration() function in Music.class.php. Because the applicationUsesDisallowedPlayerOption() function fails to reject these arguments, an authenticated administrator can use options to write files, open control channels, or create Asterisk call files, leading to arbitrary command execution as the asterisk service user.

Recommendations Update to version 17.0.7. As a temporary mitigation, restrict administrative access to the Music on Hold module configuration.