Arbitrary Code Injection Affecting azuracast/azuracast package, versions <0.23.4
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-AZURACASTAZURACAST-15460794
- published11 Mar 2026
- disclosed9 Mar 2026
- creditq1uf3ng
Introduced: 9 Mar 2026
CVE NOT AVAILABLE CWE-94 (opens in a new tab)How to fix?
Upgrade azuracast/azuracast to version 0.23.4 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Code Injection via improper sanitization in the cleanUpString function. An attacker can execute arbitrary commands on the server by injecting specially crafted Liquidsoap string interpolation sequences into user-controllable fields that are processed and embedded in the configuration file. This is only exploitable if the attacker has either Media or Profile permissions and the station is restarted, causing the malicious configuration to be parsed.