CVE-2026-73662 is an OS command injection flaw (CWE-78) in the Music on Hold module of FreePBX. An authenticated administrator can pass player options that run commands as the asterisk user. The record rates it High at 7.2. Version 17.0.7 fixes it, so upgrade.
What's affected
The record says FreePBX from 17.0.1 until 17.0.7 is affected, and that 17.0.7 contains the fix. The module involved is Music on Hold, in the file Music.class.php, where the function validateCustomConfiguration() allows dangerous options for mpg123 and other permitted players.
The attacker must already be a FreePBX administrator. The advisory describes impact as arbitrary command execution as the FreePBX service user, typically asterisk.
Severity, as two sources state it. The record gives 7.2 (High) under CVSS 3.1. The FreePBX advisory scores the issue under CVSS 4.0 at 7.5 (High), so both sources agree on the band.
How to check if you're exposed
On the FreePBX host, list module versions with the command line tool.
fwconsole ma list | grep -E "music|api|core"
fwconsole ma showupgrades
The module pages in the administrator interface show the same information under Module Admin. Compare the version of the module named in this CVE with the fixed version in the advisory.
The advisory also suggests a check for past misuse: look at the application column of the music database table for suspicious entries. A custom player command that includes file writing options, control channels or call file creation is not what a music setup should contain.
What to do now
- Update the music module to the latest version, which is 17.0.7 or later according to the record.
- Check the application column of the music table for entries you did not create, as the advisory advises.
- Limit access to the administrator control panel using FreePBX User Management, the SysAdmin VPN, MFA or SAML modules.
- Deny access to the control panel from hostile networks with the FreePBX Firewall module.
- Review administrator accounts, and remove any that are unused or shared.
Why it matters
The weakness is OS command injection, CWE-78. The module lets administrators define a custom application to play music, and it checks the command line against a list of options that are not allowed. The record says that list did not reject options that write files, open control channels or create Asterisk call files. Each of those turns a media player into a way to run something else.
The pattern is the usual one for denylists around powerful tools: the tool has many options and the filter knows only some. A telephony server is also a sensitive host, since it sits on the network edge, handles call records, and often holds trunk credentials. An attacker who gets the asterisk account can reach all of that. KEV status is false for this record.
Quick check
Does this need a login?
Yes, an administrator account on FreePBX is required, so protecting that interface is the first line of defence.
Which versions do I need?
Anything from 17.0.1 up to but not including 17.0.7 is affected. Move to 17.0.7 or later.
Sources
Last reviewed: 18 October 2026.
