SB2026102504 - Multiple vulnerabilities in AzuraCast

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-100847)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, including administrator usernames, email addresses, password hashes, and station settings.

The vulnerability exists due to improper neutralization of special elements in data query logic in AzuraCast's backend/src/Controller/Api/Stations/AbstractSearchableListAction.php when processing the sortOrder GET parameter and passing it directly to addOrderBy(). A remote attacker can submit crafted requests to the station requests API with query parameters such as sort=genre&sortOrder=asc,%20CASE%20WHEN%20EXISTS(SELECT%201%20FROM%20App%5CEntity%5CUser%20u%20WHERE%20u.id=1)%20THEN%20sm.id%20ELSE%20(0-sm.id)%20END to inject DQL expressions and infer sensitive database contents from changes in result ordering.

2) Code Injection (CVE-ID: CVE-2026-76836)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary operating system commands through unauthorized modification of AzuraCast's Liquidsoap configuration.

The vulnerability exists due to code injection and incorrect authorization in the PUT /api/station/{station_id}/profile/edit endpoint when processing backend_config custom configuration fields through the profile edit serialization context. A remote user can use manage station profile permission, without Broadcasting permission, to submit Liquidsoap code invoking process.run() or process.exec(), which is written verbatim into the generated .liq script and executes operating system commands when the built-in sync task automatically restarts the Liquidsoap backend.

Remediation

Install update from vendor's website.

References

• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-jqwc-h3rq-frmw
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q8wg-3qg7-8pc7