CVE-2026-73662

UNKNOWN 0.0

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.

CWE	CWE-78
Vendor	freepbx
Product	music
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for freepbx music

Be the first to know when new unknown vulnerabilities affecting freepbx music are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FreePBX / music

< 17.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p97w-rq48-p8q2 github.com: https://github.com/FreePBX/music/commit/9f45605982202a34244ff22c4f635af0dfc1a733