CVE-2026-42605

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.

• CWE-22

• https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808dPatch
• https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6Product
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478jExploit, Mitigation, Vendor Advisory
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478jExploit, Mitigation, Vendor Advisory

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42599Svelte is a performance oriented web framework. Prior to ver…6.1
• CVE-2026-42600MinIO is a high-performance object storage system. From RELE…4.9
• CVE-2026-42601ArchiveBox is an open source self-hosted web archiving syste…9.8
• CVE-2026-42602azureauthextension is the Azure Authenticator Extension. Fro…8.1
• CVE-2026-42603OWASP BLT is a QA testing and vulnerability disclosure platf…8.8
• CVE-2026-42604Actual is a local-first personal finance tool. The `POST /op…6.9
• CVE-2026-42606AzuraCast is a self-hosted, all-in-one web radio management …8.8
• CVE-2026-42607Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an…9.1
• CVE-2026-42608Grav is a file-based Web platform. Prior to 2.0.0-beta.2, th…9.1
• CVE-2026-42609Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a …8.1
• CVE-2026-4261The Expire Users plugin for WordPress is vulnerable to Privi…8.8
• CVE-2026-42610Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a …6.5