CVE-2025-67737— AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Quick assessment
Affected
AzuraCast AzuraCast
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AzuraCast是AzuraCast公司的一个简单的自托管网络广播管理套件。 AzuraCast 0.23.1版本存在安全漏洞，该漏洞源于错误包含仅供内部使用的API端点，可能导致数据库内容被篡改。
Possible ATT&CK Techniques 3 AI
T1110 · Brute Force T1595 · Active Scanning T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-67737
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Source: CVE Program / CVE List V5
Vulnerability Description
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
AzuraCast 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AzuraCast是AzuraCast公司的一个简单的自托管网络广播管理套件。 AzuraCast 0.23.1版本存在安全漏洞，该漏洞源于错误包含仅供内部使用的API端点，可能导致数据库内容被篡改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-67737
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-67737
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-67737 (1)
Vendor Advisories for CVE-2025-67737 (1)
-
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-9449-rphm-mjqr x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: AzuraCast
-
CVE-2026-76836
AzuraCast through 0.23.8 Liquidsoap Configuration Write via -
CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En -
CVE-2026-42606
AzuraCast: Password Reset Poisoning via Untrusted X-Forwarde -
CVE-2023-2531
Improper Restriction of Excessive Authentication Attempts in -
CVE-2023-2191
Cross-site Scripting (XSS) - Stored in azuracast/azuracast
Same weakness: CWE-862
-
CVE-2026-56092
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-77128
Broken Access Control in extension "Event management and reg -
CVE-2026-77133
Broken Access Control in extension "femanager" (femanager) -
CVE-2026-77141
Broken Access Control in extension "Club Directory" (clubdir -
CVE-2026-77140
Broken Access Control in extension "Telephone Directory" (te
V. Comments for CVE-2025-67737
No comments yet