CVE-2025-67737
Description
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.
How to fix
- azuracast azuracast0.23.2 or later
- azuracast/azuracast0.23.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azuracast azuracast | v < 0.23.2 | 0.23.2 |
| azuracast/azuracastPackagist | v < 0.23.2 | 0.23.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.