Vulnerabilities

TI-2026-30885 CVE-2026-42605 · GHSA-vp2f-cqqp-478j

AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload

HIGH 73

AzuraCast is a self-hosted, all-in-one web radio management suite.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00832 Published 2026-05-09 Fixed in 0.23.6 CWE-22

TI-2026-30886 CVE-2026-42606 · GHSA-gv7r-3mr9-h5x8

HIGH 73

AzuraCast is a self-hosted, all-in-one web radio management suite.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00476 Published 2026-05-09 Fixed in 0.23.6 CWE-640

TI-2025-41433 CVE-2025-67737 · GHSA-9449-rphm-mjqr

LOW 17

AzuraCast is a self-hosted, all-in-one web radio management suite.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00249 Published 2025-12-12 Fixed in 0.23.2 CWE-862

TI-2023-02372 CVE-2023-2531 · GHSA-4m7v-wr6v-2mw5

HIGH 81

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00787 Published 2023-05-05 Fixed in 0.18.3 CWE-307

TI-2023-02055 CVE-2023-2191 · GHSA-q55c-hmpf-6h2g

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00504 Published 2023-04-20 Fixed in 0.18, 0.18.0 CWE-79