{"id":"CVE-2025-67737","title":"AzuraCast is a self-hosted, all-in-one web radio management suite","summary":"AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast …","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-862"],"vendor":"azuracast","product":"azuracast","affected":["azuracast < 0.23.2"],"patched":["azuracast 0.23.2"],"published":"2025-12-12","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67737","references":[{"url":"https://github.com/AzuraCast/AzuraCast/commit/34620dbad93f6cd8e209a4220e3e53c7c5fea844","label":"security-advisories@github.com"},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-9449-rphm-mjqr","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00249,"epssPercentile":0.15094,"ingestedAt":"2026-10-14T17:44:53.603Z","slug":"CVE-2025-67737","body":"## Overview\n\nAzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.\n\n## Affected\n\n- `azuracast < 0.23.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `azuracast 0.23.2`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}