PT-2025-50896 · Azuracast+1 · Azuracast+1

Published 2025-12-12 · Updated 2026-02-17 · CVE-2025-67737

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AzuraCast versions 0.23.1

Description AzuraCast is a self-hosted, all-in-one web radio management suite. Version 0.23.1 mistakenly includes an API endpoint intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API. A user with knowledge of a station's operations can craft a custom HTTP request to affect the station's database. Exploitation requires a valid SFTP station username and knowledge of the internal filesystem structure. The vulnerable API endpoint is exposed through the public-facing HTTP API. The username and internal filesystem structure are required for a successful attack.

Recommendations Update to version 0.23.2 or later.

Exploit

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-67737

GHSA-9449-RPHM-MJQR

Affected Products

Azuracast

Sftpgo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67737.json · Exploit
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-9449-rphm-mjqr · Vendor Advisory
• https://github.com/AzuraCast/AzuraCast/commit/34620dbad93f6cd8e209a4220e3e53c7c5fea844 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67737 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67737 · Vendor Advisory
• https://t.me/CVEtracker/39593 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://t.me/cveNotify/145566 · Telegram Post
• https://t.me/cveNotify/152169 · Telegram Post