{"items":[{"id":"NVI-00006523","kind":"vulnerability","title":"AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-9449-rphm-mjqr","CVE-2025-67737"],"plain_summary":"OSV carries this publisher advisory for azuracast/azuracast. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 0.23.2 for azuracast/azuracast. Confirm the publisher’s latest guidance.","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0b8a54316049081dabd07630ebbb2a1b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-14T17:10:00.210Z","value":"3.1 LOW (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-d34a15980674b2244c99e0e5b083b2b3"},{"kind":"CVSS","as_of":"2026-10-14T17:10:00.210Z","value":"3.7 LOW (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-d34a15980674b2244c99e0e5b083b2b3"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.249%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.16371. Missing scores are unknown.","source_id":"sr-0b8a54316049081dabd07630ebbb2a1b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b80ef12797207c576db20fec97de55a4","url":"https://github.com/advisories/GHSA-9449-rphm-mjqr","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-9449-rphm-mjqr","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.678Z"},{"id":"sr-d34a15980674b2244c99e0e5b083b2b3","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67737","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2025-67737","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T01:40:29.811Z"},{"id":"sr-0b8a54316049081dabd07630ebbb2a1b","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2025-67737","publisher":"FIRST EPSS","observed_at":"2026-11-06T00:24:57.621Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"technology":"azuracast/azuracast","known_exclusions":[],"conditions_summary":"An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast installations.\n\nThis would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station.\n\nWith a request like:\n\n```\ncurl -s -X POST \"http://localhost/api/internal/sftp-event\"   -H \"Content-Type: application/json\"   -d '{\n    \"action\": \"pre-delete\",\n    \"username\": \"admin\",\n    \"path\": \"/var/azuracast/stations/test/media/test.mp3\"\n}'\n```\n\nA remote user could simulate a request from `sftpgo` informing the software that a file was about to be deleted from the path given. In anticipation of this, AzuraCast would delete the corresponding database record for that file. While AzuraCast would then later discover on its own that the file actually exists and recreate the media record, it would not have the same playlist associations or custom metadata as the previous instance of the media record in the database.\n\nSome mitigating factors affecting the severity of this issue include:\n - A user","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 0.23.2"]}],"null_published_at":"2026-11-08T15:11:49.423Z","source_updated_at":"2025-12-12T16:19:04.329Z","source_disclosed_at":"2025-12-11T17:01:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.678Z"},{"id":"NVI-00006523","kind":"vulnerability","title":"AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-9449-rphm-mjqr","CVE-2025-67737"],"plain_summary":"OSV carries this publisher advisory for azuracast/azuracast. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 0.23.2 for azuracast/azuracast. Confirm the publisher’s latest guidance.","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1d45d99068b71ef9589dd0ebd4565f78"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-14T17:10:00.210Z","value":"3.1 LOW (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-d34a15980674b2244c99e0e5b083b2b3"},{"kind":"CVSS","as_of":"2026-10-14T17:10:00.210Z","value":"3.7 LOW (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-d34a15980674b2244c99e0e5b083b2b3"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.249%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.16319. Missing scores are unknown.","source_id":"sr-1d45d99068b71ef9589dd0ebd4565f78"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b80ef12797207c576db20fec97de55a4","url":"https://github.com/advisories/GHSA-9449-rphm-mjqr","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-9449-rphm-mjqr","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.678Z"},{"id":"sr-d34a15980674b2244c99e0e5b083b2b3","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67737","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2025-67737","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T01:40:29.811Z"},{"id":"sr-1d45d99068b71ef9589dd0ebd4565f78","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2025-67737","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.261Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"technology":"azuracast/azuracast","known_exclusions":[],"conditions_summary":"An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast installations.\n\nThis would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station.\n\nWith a request like:\n\n```\ncurl -s -X POST \"http://localhost/api/internal/sftp-event\"   -H \"Content-Type: application/json\"   -d '{\n    \"action\": \"pre-delete\",\n    \"username\": \"admin\",\n    \"path\": \"/var/azuracast/stations/test/media/test.mp3\"\n}'\n```\n\nA remote user could simulate a request from `sftpgo` informing the software that a file was about to be deleted from the path given. In anticipation of this, AzuraCast would delete the corresponding database record for that file. While AzuraCast would then later discover on its own that the file actually exists and recreate the media record, it would not have the same playlist associations or custom metadata as the previous instance of the media record in the database.\n\nSome mitigating factors affecting the severity of this issue include:\n - A user","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 0.23.2"]}],"null_published_at":"2026-11-07T22:29:23.445Z","source_updated_at":"2025-12-12T16:19:04.329Z","source_disclosed_at":"2025-12-11T17:01:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:10.678Z"},{"id":"NVI-00006523","kind":"vulnerability","title":"AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9449-rphm-mjqr","CVE-2025-67737"],"plain_summary":"OSV carries this publisher advisory for azuracast/azuracast. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 0.23.2 for azuracast/azuracast. Confirm the publisher’s latest guidance.","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1d45d99068b71ef9589dd0ebd4565f78"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.249%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.16319. Missing scores are unknown.","source_id":"sr-1d45d99068b71ef9589dd0ebd4565f78"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b80ef12797207c576db20fec97de55a4","url":"https://github.com/advisories/GHSA-9449-rphm-mjqr","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-9449-rphm-mjqr","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.678Z"},{"id":"sr-1d45d99068b71ef9589dd0ebd4565f78","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2025-67737","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.261Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"technology":"azuracast/azuracast","known_exclusions":[],"conditions_summary":"An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast installations.\n\nThis would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station.\n\nWith a request like:\n\n```\ncurl -s -X POST \"http://localhost/api/internal/sftp-event\"   -H \"Content-Type: application/json\"   -d '{\n    \"action\": \"pre-delete\",\n    \"username\": \"admin\",\n    \"path\": \"/var/azuracast/stations/test/media/test.mp3\"\n}'\n```\n\nA remote user could simulate a request from `sftpgo` informing the software that a file was about to be deleted from the path given. In anticipation of this, AzuraCast would delete the corresponding database record for that file. While AzuraCast would then later discover on its own that the file actually exists and recreate the media record, it would not have the same playlist associations or custom metadata as the previous instance of the media record in the database.\n\nSome mitigating factors affecting the severity of this issue include:\n - A user","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 0.23.2"]}],"null_published_at":"2026-11-04T18:04:03.125Z","source_updated_at":"2025-12-12T16:19:04.329Z","source_disclosed_at":"2025-12-11T17:01:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.678Z"},{"id":"NVI-00006523","kind":"vulnerability","title":"AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9449-rphm-mjqr","CVE-2025-67737"],"plain_summary":"OSV carries this publisher advisory for azuracast/azuracast. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 0.23.2 for azuracast/azuracast. Confirm the publisher’s latest guidance.","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b80ef12797207c576db20fec97de55a4","url":"https://github.com/advisories/GHSA-9449-rphm-mjqr","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-9449-rphm-mjqr","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.678Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b80ef12797207c576db20fec97de55a4"],"technology":"azuracast/azuracast","known_exclusions":[],"conditions_summary":"An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast installations.\n\nThis would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station.\n\nWith a request like:\n\n```\ncurl -s -X POST \"http://localhost/api/internal/sftp-event\"   -H \"Content-Type: application/json\"   -d '{\n    \"action\": \"pre-delete\",\n    \"username\": \"admin\",\n    \"path\": \"/var/azuracast/stations/test/media/test.mp3\"\n}'\n```\n\nA remote user could simulate a request from `sftpgo` informing the software that a file was about to be deleted from the path given. In anticipation of this, AzuraCast would delete the corresponding database record for that file. While AzuraCast would then later discover on its own that the file actually exists and recreate the media record, it would not have the same playlist associations or custom metadata as the previous instance of the media record in the database.\n\nSome mitigating factors affecting the severity of this issue include:\n - A user","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 0.23.2"]}],"null_published_at":"2026-10-31T22:13:10.060Z","source_updated_at":"2025-12-12T16:19:04.329Z","source_disclosed_at":"2025-12-11T17:01:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.678Z"}],"next_cursor":null,"snapshot_revision":"42594"}