CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload
Authenticated users can exploit path traversal in media uploads to write arbitrary files, enabling remote code execution on AzuraCast installations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42605?
CVE-2026-42605 is a high-severity path traversal vulnerability in AzuraCast, published on 9 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.
Weakness: CWE-22
Which versions are affected by CVE-2026-42605?
2 open source packages ship an affected version, including azuracast/azuracast. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
azuracast/azuracast Packagist | All versions | 0.23.6 |
azuracast/azuracast Packagist | All versions | 0.23.6 |
Products include Azuracast Azuracast.
How do I fix CVE-2026-42605?
Upgrade azuracast/azuracast to 0.23.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42605 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42605 exists.
Other vulnerabilities in AzuraCast
- CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass
- CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
- CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast
- CVE-2025-67737 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Sources
Also known as GHSA-vp2f-cqqp-478j.