CVE-2026-42605
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability in AzuraCast prior to version 0.23.6 allows an authenticated user with media management permissions to write arbitrary files outside the station's media storage directory via an unsanitized currentDirectory parameter in the Flow.js upload endpoint. This can lead to remote code execution by writing a PHP webshell.
Risk Assessment
An attacker can achieve remote code execution on the server, potentially leading to full compromise of the application and data.
Recommendation
Update AzuraCast to version 0.23.6 or later.
Other vulnerabilities in AzuraCast
See all- CVE-2026-76836High
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.
- CVE-2026-42606High
AzuraCast before version 0.23.6 has a vulnerability in the ApplyXForwarded middleware that unconditionally trusts the X-Forwarded-Host header without a trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL by injecting this header during the forgot-password flow. When the victim clicks the link, the reset token is exfiltrated, allowing full account takeover and destruction of 2FA configuration.
Original NVD description (English source)
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.