CVE-2026-100857
CVE-2026-100857 · AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.
CVSS 8.6 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
azuracast
- Versions
- ≥ 0, < 0.23.4: Affected (semver)
- 0.23.4: Not affected (semver)
Update to 0.23.4
azuracast/azuracast Packagist
- Versions
- 0.10.0
- 0.10.1
- 0.10.2
- 0.10.3
- 0.10.4
- 0.11
- 0.11.1
- 0.11.2
- 0.12
- 0.12.1
- 0.12.2
- 0.12.3
- 0.12.4
- 0.13.0
- 0.14.0
- 0.14.1
- 0.15.0
- 0.15.1
- 0.15.2
- 0.16.0
- 0.16.1
- 0.17.0
- 0.17.1
- 0.17.2
- 0.17.3
- 0.17.4
- 0.17.5
- 0.17.6
- 0.17.7
- 0.18.0
- 0.18.1
- 0.18.2
- 0.18.3
- 0.18.5
- 0.19.0
- 0.19.1
- 0.19.2
- 0.19.3
- 0.19.4
- 0.19.5
- 0.19.6
- 0.19.7
- 0.20.0
- 0.20.1
- 0.20.2
- 0.20.3
- 0.20.4
- 0.21.0
- 0.22.0
- 0.22.1
- 0.23.0
- 0.23.1
- 0.23.2
- 0.23.3
- 0.3.1
- 0.3.2
- 0.3.3
- 0.5.0
- 0.6.0
- 0.8.0
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.4.1
- 0.9.4.2
- 0.9.5
- 0.9.5.1
- 0.9.6
- 0.9.6.1
- 0.9.6.2
- 0.9.6.5
- 0.9.7
- 0.9.7.1
- 0.9.8
- 0.9.8.1
- 0.9.9
- Affected ranges
- ECOSYSTEM: < 0.23.4
Update to 0.23.4