CVE-2026-67917

CriticalCVSS 9.8

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

SQL injection vulnerability in zuraCast up to and including 0.23.7 exists in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization, allowing a remote attacker to escalate privileges.

Risk Assessment

An attacker can exploit the vulnerability to execute arbitrary SQL queries, potentially leading to database takeover, privilege escalation, and full system compromise.

Recommendation

Update zuraCast to a version newer than 0.23.7 and ensure backup files are validated before execution.

Original NVD description (English source)

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges