PT-2026-99472 · Azuracast · Azuracast

Alpastx

·

CVE-2026-100852

·

Published

2026-09-27

·

Updated

2026-10-01

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8
Description Command injection occurs during Liquidsoap configuration generation for live recording because the streamer username is not properly quoted in process.run calls. Authenticated station users possessing Streamers and Profile permissions can set a username containing shell metacharacters, allowing them to execute arbitrary commands as the Liquidsoap process user when a recording is closed.
Recommendations Update to version 0.23.8 or later.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-100852
GHSA-73RF-JP3G-8RCF

Affected Products

Azuracast