PT-2026-26498

Summary AzuraCast's ConfigWriter::cleanUpString method fails to sanitize Liquidsoap string interpolation sequences ..., allowing authenticated users with StationPermissions::Media or StationPermissions::Profile permissions to inject arbitrary Liquidsoap code into the generated configuration file...

PT-2026-99477

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.4 Description An issue exists in the ConfigWriter::cleanUpString function that fails to sanitize Liquidsoap string interpolation sequences. Authenticated users with Media or Profile permissions can exploit this...