CVE-2026-42605 Details
Description
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.
A path traversal vulnerability has been identified in AzuraCast versions prior to 0.23.6. The issue arises in the Flow.js media upload endpoint, where the 'currentDirectory' request parameter is not properly sanitized. This flaw enables authenticated users with media management permissions to write arbitrary files outside the designated media storage directory, particularly when using the default local filesystem storage. The vulnerability can be exploited by uploading a PHP webshell to the web root, leading to remote code execution.
Users can update to AzuraCast version 0.23.6 or later, where this vulnerability has been patched. The update is available through the AzuraCast update process.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d | [email protected] | Patch |
| https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6 | [email protected] | Product |
| https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| azuracast azuracast | < 0.23.6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |