CVE-2026-100850 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can create or update a playlist with source=remote_url and remote_type=playlist whose remote_url points at a file:// path or an internal/loopback/link-local HTTP endpoint. When AutoDJ builds the queue, the backend passes the user-supplied URL directly to file_get_contents() with no scheme allowlist and no private/loopback/metadata IP policy (PHP allow_url_fopen is enabled by default, including in the Docker image). Lines from the fetched resource are parsed as M3U/PLS entries, stored in StationQueue.autodj_custom_uri, and returned by GET /api/station/{station_id}/queue to any user with the Broadcasting permission, disclosing host files readable by the web container (for example /etc/passwd or the application .env) and the bodies of non-blind internal HTTP requests. No patched version was available at the time of publication.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions prior to 0.23.8 represents a critical server-side request forgery combined with local file inclusion, stemming from insufficient input validation within the AutoDJ subsystem. Specifically, the flaw resides in the getMediaFromRemoteUrl function located in backend/src/Radio/AutoDJ/QueueBuilder.php. This component is responsible for fetching media content from remote sources to populate the station's playback queue. The core technical deficiency lies in the direct pass-through of user-supplied URLs to PHP’s file_get_contents() function without implementing any scheme allowlisting or IP address policy restrictions. Because the application environment, particularly within Docker deployments, typically has the PHP configuration directive allow_url_fopen enabled by default, it permits the execution of various URL wrappers including local filesystem access and internal network requests. This architectural oversight allows an authenticated user possessing only the Media permission to manipulate the playlist source type to remote_url with a remote_type of playlist, thereby injecting maliciously crafted URLs that target sensitive local resources or internal services.
From a technical perspective, the exploitation vector relies on the application’s failure to sanitize or validate the protocol scheme and destination IP address before processing the URL. An attacker can supply a file:// URI pointing to arbitrary files on the server's filesystem, such as /etc/passwd or the application's .env configuration file containing database credentials and API keys. Alternatively, by specifying an HTTP endpoint that resolves to loopback addresses like 127.0.0.1, localhost, or link-local IPs, the attacker can force the backend server to make internal requests to services running on the same host but potentially inaccessible from outside the container network. This effectively bypasses perimeter security controls and allows for non-blind SSRF attacks where the response body is returned directly to the user interface. The fetched content lines are then parsed as M3U or PLS playlist entries, stored in the StationQueue.autodj_custom_uri field, and subsequently exposed through the GET /api/station/{station_id}/queue endpoint.
The operational impact of this vulnerability is severe due to its potential for significant data exfiltration and internal network reconnaissance. Since any user with the Broadcasting permission can retrieve the queue contents, the disclosed information becomes widely accessible within the application's access control scope. The disclosure of host files readable by the web container provides attackers with critical system intelligence, including user accounts, file permissions, and sensitive configuration details that facilitate further compromise. Furthermore, the ability to read the bodies of internal HTTP requests enables the extraction of data from backend services such as database interfaces, message queues, or other microservices that may not have their own authentication mechanisms when accessed locally. This dual nature of the flaw classifies it under CWE-918 for Server-Side Request Forgery and CWE-22 for Improper Limitation of a Pathname to a Restricted Directory, highlighting both the network-based attack vector and the local file access risk.
In terms of threat modeling, this vulnerability aligns with ATT&CK technique T1071 Application Layer Protocol for initial data exfiltration via HTTP responses, as well as T1534 Internal Spearphishing if used to pivot laterally within a compromised environment by accessing internal APIs. The lack of an allowlist for URL schemes and the absence of private IP filtering are common misconfigurations in web applications that handle user-provided URLs. To mitigate this risk, immediate remediation involves upgrading AzuraCast to version 0.23.8 or later where these validation checks have been implemented. In environments where patching is not immediately feasible, administrators should enforce strict input validation on the remote_url parameter to reject file:// schemes and any IP addresses belonging to private ranges (RFC 1918), loopback networks, or link-local scopes. Additionally, disabling allow_url_fopen in PHP configuration if it is not strictly required for other application functions can provide a layer of defense-in-depth against local file inclusion attacks.