Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: AzuraCast 0.24.0 Clear all filters
TI-2026-84315 CVE-2026-121433 · GHSA-69c2-7h9f-h4x5

Stored CSV formula injection in AzuraCast bulk media export

Priority LOW 23

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00199 Published 2026-11-03 Fixed in 0.24.0 CWE-1236
TI-2026-84314 CVE-2026-121432 · GHSA-w4gr-g696-2mxp

AzuraCast CRLF Injection via Mount display_name in PLS Playlist

Priority LOW 22

AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00191 Published 2026-11-03 Fixed in 0.24.0 CWE-93
TI-2026-84313 CVE-2026-121431 · GHSA-8x7j-92r4-99vr

Server-side request forgery in AzuraCast webhook connectors

Priority LOW 30

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connecto…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00275 Published 2026-11-03 Fixed in 0.24.0 CWE-918
TI-2026-84312 CVE-2026-121430 · GHSA-5p6h-gpj3-x86x

Missing authorization in AzuraCast station waveform endpoints

Priority MEDIUM 57

AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00143 Published 2026-11-03 Fixed in 0.24.0 CWE-862