Application command is not in the allowed list

[penguinpbx (C. Maj)]

@pbxforge.dev

raise issue in github for Sangoma to add “/bin/mpg123”

Seems reasonable but curious what the underlying Linux flavor was @guillaumesoucy94 ?

@BlazeStudios

checks that no one wanted

The checks were added to address two security issues raised by independent researchers in accordance with the project security policy:

Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

Summary The FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. Common Vulnerabilities and Exposures (CVE) CVE-2026-45562 Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red) A - Amber Link to Published GitHub Security Advisory (GHSA) with More Details Highlights Us…

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

Summary Custom Music on Hold applications allow some dangerous options that can result in privilege escalation and execution of commands on the host as the Asterisk service user (typically asterisk.) Authentication with an existing FreePBX administrator account is required. Common Vulnerabilities and Exposures (CVE) Requested GitHub Security Advisory (GHSA) GHSA-p97w-rq48-p8q2 Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red) G - Green Link to Published GHSA with More D…