14 matches found
CVE-2026-76836
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...
CVE-2026-76836
AzuraCast (through 0.23.8 ) allows a station manager holding only the Profile permission to write Liquidsoap custom configuration fields via PUT /api/station/{station_id}/profile/edit. The root cause is that the backend_config property is serialized under GROUP_GENERAL without field-level permiss...
CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...
EUVD-2026-65008
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...
GHSA-Q4PH-8X8G-95F8 AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Summary The cleanUpString method in ConfigWriter.php uses an ungreedy regex to strip Liquidsoap string interpolation patterns ... from user input. This regex can be bypassed via nested interpolation syntax EXPR, allowing injection of arbitrary Liquidsoap code. Commit ff49ef4 migrated most...
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Summary The cleanUpString method in ConfigWriter.php uses an ungreedy regex to strip Liquidsoap string interpolation patterns ... from user input. This regex can be bypassed via nested interpolation syntax EXPR, allowing injection of arbitrary Liquidsoap code. Commit ff49ef4 migrated most...
GHSA-4FM3-GGG2-C6QX AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Summary The /api/internal/stationid/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Summary The /api/internal/stationid/liquidsoap/action endpoint is accessible from the public web interface because it lacks the RequireInternalConnection middleware that protects other internal endpoints /sftp-auth, /sftp-event. Combined with a logic flaw where the $asAutoDj flag is set based on...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the /api/internal/stationid/liquidsoap/action endpoint due to missing internal connection requirements and improper validation of the X-Liquidsoap-Api-Key header. An attacker can inject arbitrary metadata, disru...
GHSA-93FX-5QGC-WR38 AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Summary AzuraCast's ConfigWriter::cleanUpString method fails to sanitize Liquidsoap string interpolation sequences ..., allowing authenticated users with StationPermissions::Media or StationPermissions::Profile permissions to inject arbitrary Liquidsoap code into the generated configuration file...
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Summary AzuraCast's ConfigWriter::cleanUpString method fails to sanitize Liquidsoap string interpolation sequences ..., allowing authenticated users with StationPermissions::Media or StationPermissions::Profile permissions to inject arbitrary Liquidsoap code into the generated configuration file...
EUVD-2008-4944
Malware in sbrugna...