Arbitrary Command Execution Vulnerability in FreePBX Music on Hold Module

CVE-2026-45562

What is CVE-2026-45562?

The Music on Hold (MoH) module in FreePBX versions before 16.0.4 and 17.0.6 contains a significant security flaw. This vulnerability allows authenticated users, such as those with administrator privileges, to execute arbitrary system commands with the privileges of the Asterisk service. The root of the issue is found in the module's handling of POST parameters, which allows a custom Asterisk application to be stored in the database without proper sanitization. This unsanitized data is later written to the musiconhold_additional.conf configuration file, which is executed by Asterisk. Attackers can exploit this lack of validation to inject malicious commands that run under the context of the Asterisk service, potentially compromising the entire system.

References