CVE-2026-67917

creationtimestamp| type| source ---|---|--- 2026-08-18 16:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtenacnjjb2u...

CVE-2026-67917

zuraCast versions ≤0.23.7 execute the db.sql file from a backup archive during restore without validation or sanitization, allowing SQL injection and privilege escalation. CVSS 9.8 (network, no auth). A PoC is referenced at https://github.com/luoxuanxi/SQL-Injection-PoC/tree/main/SQL-Injection-Po...