CVE-2026-100852 in AzuraCastinformazioni

Riassunto

di MITRE • 27/09/2026

AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsabile

VulnCheck

Prenotare

27/09/2026

Divulgazione

27/09/2026

Moderazione

accettato

CPE

pronto

EPSS

0.00000

KEV

no

Attività

molto basso

Fonti

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-100852
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-100852
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-100852/

◂ PrecedenteVisione D'ensembleIl prossimo ▸

Interested in the pricing of exploits?

See the underground prices here!