CVE-2026-125395

MEDIUM 5.4

Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

CWE	CWE-79
Vendor	ampache
Product	ampache
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ampache ampache

Be the first to know when new medium vulnerabilities affecting ampache ampache are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

ampache / ampache

0 < 8.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18 github.com: https://github.com/ampache/ampache github.com: https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70 github.com: https://github.com/ampache/ampache/releases/tag/8.4.0 vulncheck.com: https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag

Credits

leediay153 from Viettel Post lachlan