CVE-2026-121433
AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.
| CWE | CWE-1236 |
| Vendor | azuracast |
| Product | azuracast |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for azuracast azuracast
Be the first to know when new medium vulnerabilities affecting azuracast azuracast are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
AzuraCast / AzuraCast
0 < 0.24.0
References
Credits
🔍 Xzhong6