PT-2025-38382 · Unknown · Airsonic-Advanced

Mikecole-Mg · Publicado 2025-09-18 · Atualizado 2025-09-19 · CVE-2025-10669

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Airsonic-Advanced versions prior to 10.6.1

Description A vulnerability exists in Airsonic-Advanced up to version 10.6.0 within the Playlist Upload Handler component. Manipulation of the component allows for unrestricted file uploads, and the attack can be initiated remotely. The exploit is publicly available.

Recommendations Update Airsonic-Advanced to version 10.6.1 or later.

Exploit

Correção

Unrestricted File Upload

Improper Access Control

Enumeração de Fraquezas

CWE-434

CWE-284

Identificadores relacionados

CVE-2025-10669

Produtos afetados

Airsonic-Advanced

Referências · 6

• 🔥 https://github.com/mikecole-mg/security_findings/blob/main/airsonic-advanced/airsonic-rce.md · Exploit
• https://vuldb.com/?id.324790 · Nota
• https://twitter.com/CVEnew/status/1968923628793188443 · Publicação no Twitter
• https://vuldb.com/?submit.652356 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10669 · Nota de Segurança
• https://vuldb.com/?ctiid.324790 · Nota