CVE-2026-73662

Katalog CVE

CVSS 7.2 · High EPSS 0,88%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada sangoma freepbx. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 57,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-p97w-rq48-p8q2 mitigasi · advisory vendor
• https://github.com/FreePBX/music/commit/9f45605982202a34244ff22c4f635af0dfc1a733 patch