CVE-2025-67737 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

What is CVE-2025-67737?

CVE-2025-67737 is a low-severity vulnerability in AzuraCast, published on 12 Dec 2025.

Official description

AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.

Weakness: CWE-862

Which versions are affected by CVE-2025-67737?

2 open source packages ship an affected version, including azuracast/azuracast. It affects 1 product.

Products include Azuracast Azuracast.

How do I fix CVE-2025-67737?

Upgrade azuracast/azuracast to 0.23.2 or later.

Is CVE-2025-67737 being exploited?

There is no known exploitation of CVE-2025-67737 in the wild and no public exploit code.

Other vulnerabilities in AzuraCast

• CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload High 8.8
• CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass High 8.1
• CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast High 7.3
• CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9449-rphm-mjqr.