Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73662Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

High 7.6

In plain English

A high-severity OS command injection in music from FreePBX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)7.6High

Exploit odds (30 days)0.9%top 40.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.

Affected products (as reported)

Vendor	Product	Versions
FreePBX	music	< 17.0.7

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p97w-rq48-p8q2 x_refsource_CONFIRM
https://github.com/FreePBX/music/commit/9f45605982202a34244ff22c4f635af0dfc1a733 x_refsource_MISC