CVE-2025-48949

Navidrome (open source music server) contains an SQL injection vulnerability in the API endpoint /api/artist, caused by improper input validation of the role parameter. Affected versions are 0.55.0 through 0.55.2; version 0.56.0 patches the issue. The flaw could allow an attacker to inject arbitr...