CVE-2026-45562 is an OS command injection vulnerability (CWE-78) in the FreePBX Music on Hold module. The module accepts a POST parameter defining a custom Asterisk application, which is stored in the database without sanitization. This data is then written directly to the musiconhold_additional.conf configuration file without validation. Since Asterisk reads and executes commands from this configuration file, an attacker with authenticated administrator access can execute arbitrary system commands with the privileges of the Asterisk service. The vulnerability affects FreePBX versions prior to 16.0.4 and 17.0.6 and has been fixed in these versions.

An authenticated attacker with administrator privileges can execute arbitrary system commands on the underlying host with the permissions of the Asterisk service. This could lead to full system compromise depending on the privileges of the Asterisk service. The vulnerability requires valid administrator credentials but does not require user interaction beyond authentication.

Apply the official patches by upgrading FreePBX to version 16.0.4 or later, or 17.0.6 or later. These versions contain the fix that properly sanitizes and validates the POST parameter before writing to the configuration file. No other mitigation is indicated by the vendor advisory.