azuracast/azuracast

Composer · Package

9 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password FieldCVE-2026-100856 · GHSA-Q4PH-8X8G-95F8	azuracast/azuracast	Composer	High	Fix reported	2026-09-27
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data ExfiltrationCVE-2026-100855 · GHSA-QFF7-Q5FM-8P76	azuracast/azuracast	Composer	Medium	Fix reported	2026-09-27
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast DisruptionCVE-2026-100854 · GHSA-4FM3-GGG2-C6QX	azuracast/azuracast	Composer	Medium	Fix reported	2026-09-27
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLsCVE-2026-100857 · GHSA-93FX-5QGC-WR38	azuracast/azuracast	Composer	High	Fix reported	2026-09-27
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA BypassCVE-2026-42606 · GHSA-GV7R-3MR9-H5X8	azuracast/azuracast	Composer	High	Fix reported	2026-05-13
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media UploadCVE-2026-42605 · GHSA-VP2F-CQQP-478J	azuracast/azuracast	Composer	High	Fix reported	2026-05-13
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCECVE-2025-67737 · GHSA-9449-RPHM-MJQR	azuracast/azuracast	Composer	Low	Fix reported	2025-12-12
AzuraCast/AzuraCast vulnerable to cross-site scripting CVE-2023-2191 · GHSA-Q55C-HMPF-6H2G	azuracast/azuracast	Composer	Low	Fix reported	2024-02-16
AzuraCast missing brute force preventionCVE-2023-2531 · GHSA-4M7V-WR6V-2MW5	azuracast/azuracast	Composer	Critical	Fix reported	2024-02-16