PT-2025-38382 · Unknown · Airsonic-Advanced

Mikecole-Mg · Published 2025-09-18 · Updated 2025-09-19 · CVE-2025-10669

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Airsonic-Advanced versions prior to 10.6.1

Description A vulnerability exists in Airsonic-Advanced up to version 10.6.0 within the Playlist Upload Handler component. Manipulation of the component allows for unrestricted file uploads, and the attack can be initiated remotely. The exploit is publicly available.

Recommendations Update Airsonic-Advanced to version 10.6.1 or later.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2025-10669

Affected Products

Airsonic-Advanced

References · 6

• 🔥 https://github.com/mikecole-mg/security_findings/blob/main/airsonic-advanced/airsonic-rce.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10669 · Security Note
• https://vuldb.com/?id.324790 · Note
• https://twitter.com/CVEnew/status/1968923628793188443 · Twitter Post
• https://vuldb.com/?submit.652356 · Note
• https://vuldb.com/?ctiid.324790 · Note