CVE-2026-100850
Received Received - Intake

SSRF and Local File Read in AzuraCast AutoDJ

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can create or update a playlist with source=remote_url and remote_type=playlist whose remote_url points at a file:// path or an internal/loopback/link-local HTTP endpoint. When AutoDJ builds the queue, the backend passes the user-supplied URL directly to file_get_contents() with no scheme allowlist and no private/loopback/metadata IP policy (PHP allow_url_fopen is enabled by default, including in the Docker image). Lines from the fetched resource are parsed as M3U/PLS entries, stored in StationQueue.autodj_custom_uri, and returned by GET /api/station/{station_id}/queue to any user with the Broadcasting permission, disclosing host files readable by the web container (for example /etc/passwd or the application .env) and the bodies of non-blind internal HTTP requests. No patched version was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100850
EUVD
EUVD-2026-87838

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
azuracast azuracast to 0.23.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AzuraCast before 0.23.8 has a vulnerability where a user with Media permission can create a playlist with a remote URL pointing to a file:// path or internal HTTP endpoint. The backend uses file_get_contents() without restrictions to fetch this URL, allowing access to sensitive files like /etc/passwd or internal HTTP responses. The fetched content is stored and exposed via the queue API to users with Broadcasting permission.

Detection Guidance

To detect this vulnerability, check AzuraCast logs for suspicious playlist updates or file:// or internal IP URLs in remote_url fields. Inspect StationQueue.autodj_custom_uri entries for exposed sensitive files like /etc/passwd or .env. Monitor API calls to GET /api/station/{station_id}/queue for unauthorized data access.

Impact Analysis

An attacker with Media permission could read sensitive files on the server hosting AzuraCast, such as configuration files containing credentials or system files like /etc/passwd. They could also access internal HTTP responses from non-public services, potentially exposing confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Unauthorized file access or data exposure may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade AzuraCast to the latest patched version if available. If not, restrict Media user permissions to prevent playlist modifications. Disable file:// and internal IP access in remote_url handling. Replace file_get_contents() with a safer HTTP client like Guzzle and enforce scheme allowlisting for http/https only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart