CVE-2025-67737: low-severity vulnerability in AzuraCast
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.1epss 0.2%
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
AzuraCast · AzuraCastRelated CVEs — AzuraCast
In the same product, most dangerous first.
CVE-2026-100852HIGHAzuraCast before 0.23.8 Command Injection via Streamer UsernameEPSS 4.6%CVE-2026-121429HIGHAzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()EPSS 1.5%CVE-2026-42605HIGHAzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media UploadEPSS 0.8%CVE-2026-121428HIGHAzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneEPSS 0.7%CVE-2026-42606HIGHAzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassEPSS 0.5%CVE-2026-100856HIGHAzuraCast before 0.23.6 Code Injection via Remote Relay PasswordEPSS 0.5%