PT-2026-99472
CVE-2026-100852
·
تاريخ النشر
2026-09-27
·
تاريخ التحديث
2026-10-01
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
AzuraCast versions prior to 0.23.8
Description
Command injection occurs during Liquidsoap configuration generation for live recording because the streamer username is not properly quoted in
process.run calls. Authenticated station users possessing Streamers and Profile permissions can set a username containing shell metacharacters, allowing them to execute arbitrary commands as the Liquidsoap process user when a recording is closed.Recommendations
Update to version 0.23.8 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾