CVE-2025-48949 Navidrome allows SQL Injection via role parameter
Attackers can inject SQL via the role parameter in Navidrome to access the database and compromise user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48949?
CVE-2025-48949 is a high-severity SQL injection vulnerability in navidrome, published on 30 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.
Weakness: CWE-89
Which versions are affected by CVE-2025-48949?
3 open source packages ship an affected version, including github.com/navidrome/navidrome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/navidrome/navidrome Go | From 0.55.0 | 0.56.0 |
github.com/navidrome/navidrome Go | From 0.55.0 | 0.56.0 |
github.com/navidrome/navidrome Go | From 0.55.0 | 0.56.0 |
Products include Navidrome Navidrome.
How do I fix CVE-2025-48949?
Upgrade github.com/navidrome/navidrome to 0.56.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-48949 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48949 exists.
Other vulnerabilities in navidrome
- CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
- CVE-2026-25579 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints
- CVE-2024-41259 Navidrome uses MD5 hashing algorithm
- CVE-2023-51442 Authentication bypass vulnerability in navidrome's subsonic endpoint
- CVE-2025-48948 Navidrome Transcoding Permission Bypass Vulnerability Report
Sources
Also known as GHSA-5wgp-vjxm-3x2r, GO-2025-3734.