# CVE-2026-100850: AzuraCast AutoDJ server-side request forgery and local file read

Source: https://junglewise.ai/threats/cve-2026-100850-azuracast-before-0-23-8-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100850 · Severity: high · CVSS 7.7 · Published 2026-09-27

AzuraCast is a web-based radio streaming management platform. A user with station Media permissions can read sensitive files from the host system or make requests to internal services by setting a remote playlist URL to point at file paths or internal HTTP endpoints. When the AutoDJ feature builds the queue, it fetches this URL without restriction, exposing secrets like configuration files and internal service responses to other users with Broadcasting permissions.

Technologies: [AzuraCast](https://junglewise.ai/threats/technologies/azuracast). Vendors: [AzuraCast](https://junglewise.ai/threats/vendors/azuracast).

## Quick answers

**Is CVE-2026-100850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100850 being exploited in the wild.

**How severe is CVE-2026-100850?** High severity, with a CVSS score of 7.7, published 27 September 2026.

**Which products and versions are affected?** AzuraCast before 0.23.8.

**Is there a fix for CVE-2026-100850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100850 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100850?** Check whether you run AzuraCast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) and local file read flaw in backend/src/Radio/AutoDJ/QueueBuilder.php:getMediaFromRemoteUrl(). The function passes user-supplied remote_url directly to file_get_contents() with no scheme allowlist and no IP filtering, allowing file:// paths and RFC1918/loopback/metadata endpoints. Playlist entries parsed from the fetched resource are stored in StationQueue.autodj_custom_uri and exposed via the queue API to users with Broadcasting permissions. A patched version exists in 0.23.8.

## Affected products

- AzuraCast AzuraCast before 0.23.8

## Timeline

- 2026-08-08: disclosed: GitHub security advisory GHSA-rrjx-wrhf-8v47 published
- 2026-09-27: advisory: CVE-2026-100850 published on NVD

## References

- [https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-rrjx-wrhf-8v47](https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-rrjx-wrhf-8v47)
- [https://www.vulncheck.com/advisories/azuracast-before-0.23.8-ssrf-and-local-file-read-via-remote-playlist](https://www.vulncheck.com/advisories/azuracast-before-0.23.8-ssrf-and-local-file-read-via-remote-playlist)

## Related threats

- [AzuraCast server-side request forgery via webhook redirects](https://junglewise.ai/threats/cve-2026-124442-azuracast-before-0-24-0-contains-a-server-side-request-forgery)
- [AzuraCast CSV formula injection in bulk media import](https://junglewise.ai/threats/cve-2026-121433-azuracast-before-0-24-0-contains-a-stored-csv-formula-injection)
- [AzuraCast webhook connectors server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-121431-azuracast-before-0-24-0-contains-a-server-side-request-forgery)
- [AzuraCast missing authorization in waveform endpoints](https://junglewise.ai/threats/cve-2026-121430-azuracast-before-0-24-0-contains-a-missing-authorization)
- [AzuraCast command injection in StereoTool configuration](https://junglewise.ai/threats/cve-2026-121429-azuracast-through-0-23-8-contains-a-command-injection)