Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 2 | Disclosure1General1 |
| 2026-06-16 | 1 | Disclosure1 |
Unpopular opinion: The cybersecurity industry is selling you dashboards. The Escape Route: CVE-2026-42605 Path Traversal in AzuraCast Webshell Upload
Post summary
The text references CVE-2026-42605 as a path traversal issue in AzuraCast's Webshell upload, indicating a vulnerability disclosure but providing limited details.
🚨*CVE* CVE-2026-42605 AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoin… https://www.cve.org/CVERecord?id=CVE-2026-42605 ----- Traducción: CVE-2026-42605 Azu… http://infoflow.cloud`
Post summary
The post announces CVE-2026-42605 for AzuraCast, describing the affected component and version pre‑cutoff, but offers no PoC, exploit, or mitigation details.
CVE-2026-42605 AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoin… https://www.cve.org/CVERecord?id=CVE-2026-42605
Post summary
The entry briefly mentions CVE-2026-42605 with minimal technical context but lacks any evidence of exploitation, patching, or PoC details.
CVE-2026-42605 Path Traversal and Remote Code Execution in AzuraCast Before 0.23.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42605
Post summary
The text announces a Path Traversal and Remote Code Execution vulnerability in AzuraCast versions prior to 0.23.6.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | azuracast | azuracast | - | - | - |