CVE-2026-121432

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121433

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...

CVE-2026-121428

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121429

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...

CVE-2026-121427

AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...

EUVD-2026-115855

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...

CVE-2026-121433 AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...

CVE-2026-121433

AzuraCast versions before 0.24.0 are vulnerable to a stored CSV formula injection vulnerability. This issue allows users with Media permission to persist metadata containing formula-prefixed content by using the /api/station/{station_id}/files/bulk endpoint during a bulk media import. If an attac...

CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121432

AzuraCast versions prior to 0.24.0 are vulnerable to a CRLF injection vulnerability. The issue exists because the application fails to properly neutralize CR/LF sequences within mount or remote relay display_name values. Low-privilege station users possessing Station:MountPoints or Station:Remote...

CVE-2026-121431

AzuraCast versions before 0.24.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance_url, api, or webhookurl parameters to int...

EUVD-2026-115854

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...

EUVD-2026-115853

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

CVE-2026-121430

AzuraCast versions before 0.24.0 are susceptible to a missing authorization vulnerability (CWE-862) in the GET and POST routes for /api/station/{station_id}/waveform/{media_id}. Because these routes lack necessary Permissions middleware , any authenticated user—even those without specific station...

EUVD-2026-115852

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...

CVE-2026-121429 AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...

EUVD-2026-115961

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...

CVE-2026-121429

AzuraCast versions up to and including 0.23.8 are vulnerable to a command injection vulnerability. Attackers with Profile permission can execute OS commands by injecting shell metacharacters into the stereo_tool_configuration_path or stereo_tool_license_key fields within StereoTool settings. Thes...

CVE-2026-121428

AzuraCast versions through 0.23.8 are vulnerable to Remote Code Execution (RCE) due to a Supervisor configuration injection flaw in the station timezone field. Authenticated station managers can exploit the profile edit API by submitting a timezone string containing newlines. This allows the inje...