CVE-2026-100852 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions through 0.23.x represents a critical security flaw rooted in improper input validation during dynamic configuration generation for its audio streaming engine, Liquidsoap. This specific issue manifests within the module responsible for handling live recordings, where the system constructs shell commands to manage media processing tasks. The core technical deficiency lies in the failure of the application code to properly sanitize or quote user-supplied data before embedding it into operating system command strings. Specifically, when a station administrator with Streamers and Profile permissions assigns a username to a streamer account, this value is directly interpolated into process.run calls without adequate escaping mechanisms. This lack of input sanitization creates an opportunity for attackers who have authenticated access to the platform to inject arbitrary shell metacharacters into the username field.
From a technical perspective, this flaw aligns with CWE-78, which classifies Improper Neutralization of Special Elements used in an OS Command, commonly known as command injection. By exploiting the absence of proper quoting around the streamer username variable, an authenticated attacker can manipulate the structure of the underlying shell command executed by the Liquidsoap process. When a live recording session concludes and the system attempts to finalize or move the recorded file using these generated commands, the injected characters are interpreted by the operating system's command interpreter rather than being treated as literal string data. This allows the execution of arbitrary OS-level commands with the privileges associated with the user account under which the Liquidsoap service operates.
The operational impact of this vulnerability is severe due to its potential for remote code execution within the context of the application server. Since AzuraCast typically runs on a dedicated Linux-based infrastructure, compromising the Liquidsoap process can lead to full system compromise if that service account possesses elevated privileges or access to sensitive configuration files and media storage directories. An attacker could leverage this vector to exfiltrate data, install backdoors, pivot to other systems within the network, or disrupt broadcasting services by terminating critical processes. The requirement for authentication limits the attack surface compared to unauthenticated vulnerabilities but remains significant because many station operators may use predictable credentials or have weak password policies, and the ability to create streamer accounts provides a persistent foothold if not monitored closely.
This vulnerability maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh or bash. The exploitation path involves an authenticated user manipulating input parameters that are subsequently passed to the operating system's command processor. Defense in depth strategies must be employed to mitigate this risk immediately. Administrators should upgrade AzuraCast to version 0.24 or later where this issue has been patched by implementing proper string escaping and validation routines before passing data to shell commands. In environments where upgrading is not immediately feasible, restricting the permissions of the Liquidsoap service account to only those necessary for media processing can limit the blast radius of a successful exploitation attempt. Additionally, enforcing strict input validation on all user-facing fields that interact with system processes and monitoring logs for anomalous command executions are recommended interim mitigation steps.