{"action":"Upgrade azuracast/azuracast to 0.23.6 or later.","affected":[{"fixed":"0.23.6","introduced":"0"}],"component":"azuracast/azuracast","cve_ids":["CVE-2026-42605"],"ecosystem":"Packagist","epss":0.00832,"exploited":false,"fixed_versions":["0.23.6"],"ghsa_id":"GHSA-vp2f-cqqp-478j","id":"tcs_01M5KF99K8FNPCV5KAVTZ6N5E8","modified_at":"2026-05-13T13:53:07.271908Z","published_at":"2026-05-04T21:16:51Z","references":["https://osv.dev/vulnerability/GHSA-vp2f-cqqp-478j","https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j","https://nvd.nist.gov/vuln/detail/CVE-2026-42605","https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d","https://github.com/AzuraCast/AzuraCast","https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-vp2f-cqqp-478j","url":"https://osv.dev/vulnerability/GHSA-vp2f-cqqp-478j"}],"summary":"AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload"}