Read the docs
TI-2022-07860 Aliases CVE-2022-23857GHSA-pmcr-2rhp-36hr

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection…

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Why it matters now

EPSS 0.00932 60th percentileScored 2026-11-07
Fix Fixed github.com/navidrome/navidrome (Go): 0.47.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/navidrome/navidrome (Go)before 0.47.50.47.5Patch availableGHSA-pmcr-2rhp-36hr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/navidrome/navidrome (Go) Vendor— Affected before 0.47.5 Fixed in 0.47.5 Patch available GHSA-pmcr-2rhp-36hr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:*before 0.47.5Vulnerablenavidrome
  • cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:* Versions before 0.47.5 Vulnerable ·navidrome

Remediation

  • Fix · GHSA-pmcr-2rhp-36hr github.com/navidrome/navidrome (Go) Fixed in 0.47.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23857
  2. 2026-10-03 Alias added: GHSA-pmcr-2rhp-36hr

References

Patch 1

Advisory 2

Other 1

  • TI-2025-31087 Navidrome allows SQL Injection via role parameter CVSS 4.0HIGH 8.9
  • TI-2024-31444 Multiple SQL Injections and ORM Leak in navidrome CVSS 4.0CRITICAL 9.4
  • TI-2025-19982 Navidrome has authentication bypass in Subsonic API with non-existent username CVSS 4.0MEDIUM 6.9
  • TI-2025-31086 Navidrome Transcoding Permission Bypass Vulnerability Report CVSS 4.0HIGH 7.4
  • TI-2024-21830 Parameter Tampering vulnerability in Navidrome CVSS 3.1MEDIUM 4.2
  • TI-2024-27560 Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows… CVSS 3.1CRITICAL 9.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences