PT-2026-6325 · Navidrome · Navidrome

Alexgustafsson · Publicado 2026-02-04 · Atualizado 2026-02-18 · CVE-2026-25578

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Navidrome versions prior to 0.60.0

Description Navidrome is a web-based music collection server and streamer. A cross-site scripting issue exists in the frontend that allows a malicious attacker to inject code through the comment metadata of a song. This could potentially lead to the exfiltration of user credentials. The vulnerable component is the frontend application. The attack vector involves manipulating the comment metadata associated with a song.

Recommendations Update to version 0.60.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

CWE-80

Identificadores relacionados

CVE-2026-25578

GHSA-RH3R-8PXM-HG4W

GO-2026-4413

SUSE-SU-2026:0403-1

Produtos afetados

Navidrome

Referências · 90

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25578.json · Exploit
• https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w · Aviso do Fabricante
• https://github.com/navidrome/navidrome/commit/d7ec7355c9036d5be659d6ac555c334bb5848ba6 · Correção
• https://github.com/navidrome/navidrome/releases/tag/v0.60.0 · Nota
• https://github.com/navidrome/navidrome · Nota
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://suse.com/security/cve/CVE-2026-24844 · Nota
• https://suse.com/security/cve/CVE-2026-25578 · Nota
• https://suse.com/security/cve/CVE-2026-23991 · Nota
• https://suse.com/security/cve/CVE-2026-25579 · Nota