CVE-2026-121433: AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

Published Nov 3, 2026

Updated

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{stationid}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A station user who has Media permission can exploit it by importing crafted metadata through the bulk media API endpoint. The affected fields include titles, artists, and custom fields.

What user action is required for the malicious formula to run?

Another user must export the affected media data to CSV and open that CSV in a spreadsheet application that evaluates formula-prefixed cells. The issue does not execute solely from importing the metadata.

Are installations before 0.24.0 affected by default?

The issue affects AzuraCast versions before 0.24.0 when a user with Media permission can bulk-import crafted metadata and CSV exports are opened in a spreadsheet. The available information does not state whether additional configuration is required.

CVE-2026-121433: AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

Event History

Frequently Asked Questions

Who can exploit this issue?

What user action is required for the malicious formula to run?

Are installations before 0.24.0 affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What user action is required for the malicious formula to run?

Are installations before 0.24.0 affected by default?