217 matches found
CVE-2026-121432
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...
CVE-2026-121433
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
CVE-2026-121428
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...
CVE-2026-121429
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...
CVE-2026-121427
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
EUVD-2026-115855
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
CVE-2026-121433 AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
CVE-2026-121433
AzuraCast versions before 0.24.0 are vulnerable to a stored CSV formula injection vulnerability. This issue allows users with Media permission to persist metadata containing formula-prefixed content by using the /api/station/{station_id}/files/bulk endpoint during a bulk media import. If an attac...
CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...
CVE-2026-121432
AzuraCast versions prior to 0.24.0 are vulnerable to a CRLF injection vulnerability. The issue exists because the application fails to properly neutralize CR/LF sequences within mount or remote relay display_name values. Low-privilege station users possessing Station:MountPoints or Station:Remote...
CVE-2026-121431
AzuraCast versions before 0.24.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance_url, api, or webhookurl parameters to int...
EUVD-2026-115853
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...
CVE-2026-121432 AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...
EUVD-2026-115854
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and...
CVE-2026-121430
AzuraCast versions before 0.24.0 are susceptible to a missing authorization vulnerability (CWE-862) in the GET and POST routes for /api/station/{station_id}/waveform/{media_id}. Because these routes lack necessary Permissions middleware , any authenticated user—even those without specific station...
EUVD-2026-115852
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...
EUVD-2026-115961
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...
CVE-2026-121429 AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...
CVE-2026-121429
AzuraCast versions up to and including 0.23.8 are vulnerable to a command injection vulnerability. Attackers with Profile permission can execute OS commands by injecting shell metacharacters into the stereo_tool_configuration_path or stereo_tool_license_key fields within StereoTool settings. Thes...
EUVD-2026-115959
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...