CVE-2026-73662 in FreePBX
Summary
by MITRE • 08/13/2026
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within the FreePBX Music on Hold module where the validateCustomConfiguration() function in Music.class.php fails to properly sanitize command-line options passed to external media players such as mpg123. This flaw allows authenticated administrators to inject dangerous parameters that can manipulate how these applications execute, creating a path for arbitrary code execution under the privileges of the asterisk service user. The issue stems from insufficient input validation within the applicationUsesDisallowedPlayerOption() function which does not adequately filter out potentially harmful command-line arguments that could enable file creation, control channel access, or call file generation operations.
This vulnerability represents a critical privilege escalation vector that leverages the principle of least privilege violation by allowing an authenticated user with administrative privileges to execute arbitrary commands on the system. The flaw specifically affects versions 17.0.1 through 17.0.7 of FreePBX and demonstrates poor input validation practices that align with CWE-74, which covers "Improper Neutralization of Special Elements in Output Used by a Downstream Component." The security implications extend beyond simple command execution as the attacker can manipulate the underlying Asterisk system to create persistent call files or establish unauthorized control channels.
The operational impact of this vulnerability is severe as it provides an authenticated attacker with complete control over the media playback functionality and potentially broader system access. Since the execution occurs under the asterisk service user context, attackers can leverage this privilege to manipulate voicemail systems, intercept calls, modify dial plans, or even establish persistence mechanisms within the telephony infrastructure. The vulnerability also aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell and related techniques that involve executing commands through legitimate system tools.
Mitigation strategies should focus on immediate patch application to version 17.0.7 or later where the issue has been resolved through proper input validation in the validateCustomConfiguration() function. Network segmentation and privilege separation should be implemented to limit administrative access to only necessary personnel, while monitoring systems should be configured to detect unusual command execution patterns. Additionally, organizations should conduct thorough security reviews of all third-party modules within FreePBX to identify similar input validation gaps that could provide similar attack vectors. The fix demonstrates proper defensive programming practices by ensuring that all external player options are strictly validated against a known safe set of parameters rather than attempting to blacklist dangerous options which is inherently insecure.