CVE-2026-67917
Received Received - Intake

SQL Injection in ZuraCast Backup Restore

Publication date: 2026-08-17

Last updated on: 2026-08-18

Assigner: MITRE

Description
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-05
NVD
CVE-2026-67917

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
azuracast zuracast to 0.23.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

zuraCast versions up to 0.23.7 have a SQL injection flaw in the backup restore feature. The azuracast:restore command runs the db.sql file from a backup without checking or cleaning its contents. This lets attackers inject malicious SQL code to gain higher privileges.

Detection Guidance

To detect this vulnerability, check if zuraCast versions up to 0.23.7 are installed. Look for unauthorized database modifications or suspicious backup restore commands. Review logs for `azuracast:restore` executions with untrusted backup files.

Impact Analysis

An attacker could exploit this to take control of your zuraCast system, steal data, or disrupt services. Since it involves backup restoration, compromised backups could spread the issue to other systems.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties or fines.

Mitigation Strategies

Upgrade zuraCast to a version beyond 0.23.7 where the backup restore functionality has been patched to validate and sanitize SQL content. If immediate upgrade is not possible, restrict access to the backup restore feature and monitor for suspicious database activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart