CVE-2026-121433

AzuraCast versions before 0.24.0 are vulnerable to a stored CSV formula injection vulnerability. This issue allows users with Media permission to persist metadata containing formula-prefixed content by using the /api/station/{station_id}/files/bulk endpoint during a bulk media import. If an attac...