CVE-2026-42605

Packagist/azuracast/azuracast CVE-2026-42605: high 8.8, EPSS 1.03%

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

Action: Upgrade azuracast/azuracast to 0.23.6 or later.

composer require azuracast/azuracast:0.23.6

Affected

Fixed versions

Sources

• osv: GHSA-vp2f-cqqp-478j
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j
• https://nvd.nist.gov/vuln/detail/CVE-2026-42605
• https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d
• https://github.com/AzuraCast/AzuraCast
• https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6

CVE-2026-42605 · published 2026-05-04T21:16:51Z · modified 2026-05-13T13:53:07.271908Z · JSON