AzuraCast vulnerabilities
We track 14 vulnerabilities in AzuraCast products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest AzuraCast vulnerabilities
- 8.8 High severity
AzuraCast: Improper Neutralization of Special Elements used in an OS Command
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_l
- 8.8 High severity
AzuraCast: Improper Control of Generation of Code
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit AP
- 7.5 High severity
AzuraCast: External Control of System or Configuration Setting
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf fi
- 8.0 High severity
AzuraCast: Improper Control of Generation of Code
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liq
- 8.8 High severity
AzuraCast: Improper Control of Generation of Code
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap
- 8.8 High severity
AzuraCast: Improper Neutralization of Special Elements used in an OS Command
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set
- 7.6 High severity
AzuraCast: Exposure of Sensitive Information to an Unauthorized Actor
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attack
- 7.7 High severity
AzuraCast: Server-Side Request Forgery
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can create or up
- 7.1 High severity
AzuraCast: Server-Side Request Forgery
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors,
- 7.1 High severity
AzuraCast: Server-Side Request Forgery
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restricti
- 7.5 High severity
AzuraCast: Improper Neutralization of Special Elements used in an SQL Command
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information includin
- 8.8 High severity
AzuraCast: Improper Control of Generation of Code
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id
- 8.8 High severity
AzuraCast: Weak Password Recovery Mechanism for Forgotten Password
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can
- 8.8 High severity
AzuraCast: Improper Limitation of a Pathname to a Restricted Directory
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences.