Executive brief
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
Affected products
- Packagist azuracast/azuracast
Junglewise Threat Intelligence
CVE-2025-67737: AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
CVE-2025-67737 · Severity: low · CVSS 3.1 · Published 2025-12-11
Technologies: azuracast/azuracast (Packagist). Vendors: Packagist.
Related threats
- AzuraCast password reset poisoning in ApplyXForwarded middleware
- AzuraCast path traversal and RCE in Flow.js media upload
- AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
- AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
- AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption