---
id: CVE-2025-67737
title: 'AzuraCast is a self-hosted, all-in-one web radio management suite'
summary: >-
  AzuraCast is a self-hosted, all-in-one web radio management suite. Versions
  0.23.1 mistakenly include an API endpoint that is intended for internal use by
  the SFTP software sftpgo, exposing it to the public-facing HTTP API for
  AzuraCast …
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: azuracast
product: azuracast
affected:
  - azuracast < 0.23.2
patched:
  - azuracast 0.23.2
published: '2025-12-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67737'
references:
  - url: >-
      https://github.com/AzuraCast/AzuraCast/commit/34620dbad93f6cd8e209a4220e3e53c7c5fea844
    label: security-advisories@github.com
  - url: >-
      https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-9449-rphm-mjqr
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00249
epssPercentile: 0.15094
ingestedAt: '2026-10-14T17:44:53.603Z'
---

## Overview

AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.

## Affected

- `azuracast < 0.23.2`

## Remediation

Upgrade past the affected range:

- `azuracast 0.23.2`