Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getMediaFromRemoteUrl function. An attacker can access internal network resources or read arbitrary files by supplying a crafted remote playlist URL that points to internal HTTP endpoints or loca...

CVE-2026-100850: Server-Side Request Forgery (SSRF)

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...