PT-2026-6325 · Navidrome · Navidrome

Alexgustafsson · Published 2026-02-04 · Updated 2026-02-18 · CVE-2026-25578

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Navidrome versions prior to 0.60.0

Description Navidrome is a web-based music collection server and streamer. A cross-site scripting issue exists in the frontend that allows a malicious attacker to inject code through the comment metadata of a song. This could potentially lead to the exfiltration of user credentials. The vulnerable component is the frontend application. The attack vector involves manipulating the comment metadata associated with a song.

Recommendations Update to version 0.60.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-25578

GHSA-RH3R-8PXM-HG4W

GO-2026-4413

SUSE-SU-2026:0403-1

Affected Products

Navidrome

References · 90

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25578.json · Exploit
• https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w · Vendor Advisory
• https://github.com/navidrome/navidrome/commit/d7ec7355c9036d5be659d6ac555c334bb5848ba6 · Patch
• https://osv.dev/vulnerability/CVE-2026-25578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25578 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rh3r-8pxm-hg4w · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4413 · Vendor Advisory
• https://github.com/navidrome/navidrome/releases/tag/v0.60.0 · Note
• https://github.com/navidrome/navidrome · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note
• https://suse.com/security/cve/CVE-2026-25499 · Note