Application command is not in the allowed list

[guillaumesoucy94]

Hello,

When trying to make changes to the Music on hold interface it n ow throwing me this error: Application command is not in the allowed list

Probably relatef to Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files · Advisory · FreePBX/security-reporting · GitHub

my question is: how to make it works like before. I seek for some help but not sure that I want try anything, just i case if I mess-up my FreePBX system.

My MOH setup is mpg123 streaming a local stream. I worked like this since 2017 without any issues…

FreePBX is up-to-date btw.

Thanks,

Guillaume

[viktoriyanavrotskaya]

@guillaumesoucy94

Hello,

When trying to make changes to the Music on hold interface it n ow throwing me this error: Application command is not in the allowed list

Probably relatef to Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files · Advisory · FreePBX/security-reporting · GitHub

my question is: how to make it works like before. I seek for some help but not sure that I want try anything, just i case if I mess-up my FreePBX system.

My MOH setup is mpg123 streaming a local stream. I worked like this since 2017 without any issues…

FreePBX is up-to-date btw.

Thanks,

Guillaume

This looks related to the recent security changes where certain commands were restricted to prevent abuse. Since FreePBX is updated, the behavior may be intentional rather than a broken setup. I’d avoid manually changing permissions unless you know the impact. Check the FreePBX release notes or security updates for the recommended way to re-enable MOH functionality safely.

[pbxforge.dev]

Hi @guillaumesoucy94

As per the code below, it looks like mpg123 needs to be present in one of the predefined paths.

Could you please verify whether your mpg123 binary (which mpg123) is located in any of the following paths?

17.0/Music.class.php

[guillaumesoucy94]

It was that! I added the line /bin/mpg123 to Music.class.phpand it fixed the problem after applying the configuration.

Now it shows this but I can live with it if it’s just that. Hoping the file will not revert after a reboot… Fingers crossed.

For the security issue. The server is running on a local network behind a NAT. So, its less scary than a server directly facing the public internet. I think…

Btw, thanks to both of you!

[pbxforge.dev]

@guillaumesoucy94

/bin/mpg123

Best solution could be that you can raise issue in github for Sangoma to add “/bin/mpg123” into the allowed list or else you can create soft link in your system to have `/usr/bin/mpg123` point to your actual binary and use /usr/bin/mpg123 path to avoid your temp code changes.

Please note - upgrade will overwrite your changes so better to take proper solution path instead of doing such manual code changes.

Thanks

[BlazeStudios (Tom Ray)]

Or just use musiconhold_custom.conf and move the moh category settings there. It avoids the checks that no one wanted

[penguinpbx (C. Maj)]

@pbxforge.dev

raise issue in github for Sangoma to add “/bin/mpg123”

Seems reasonable but curious what the underlying Linux flavor was @guillaumesoucy94 ?

@BlazeStudios

checks that no one wanted

The checks were added to address two security issues raised by independent researchers in accordance with the project security policy:

Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

Summary The FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. Common Vulnerabilities and Exposures (CVE) CVE-2026-45562 Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red) A - Amber Link to Published GitHub Security Advisory (GHSA) with More Details Highlights Us…

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

Summary Custom Music on Hold applications allow some dangerous options that can result in privilege escalation and execution of commands on the host as the Asterisk service user (typically asterisk.) Authentication with an existing FreePBX administrator account is required. Common Vulnerabilities and Exposures (CVE) Requested GitHub Security Advisory (GHSA) GHSA-p97w-rq48-p8q2 Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red) G - Green Link to Published GHSA with More D…

[BlazeStudios (Tom Ray)]

@penguinpbx

The checks were added to address two security issues raised by independent researchers in accordance with the project security policy:

Right but how you do them no one was jiving on plus there’s that whole, can just do a work around for it thing. Not really a “security solution” overall.