UBUNTU-CVE-2026-125395: Medium severity ubuntu/ampache vulnerability
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
An attacker needs upload rights in Ampache and must upload a song with malicious HTML or script in its lyrics ID3 tag. Any user who later views the affected song's lyrics can have the script execute in their browser.
Does exploitation require user interaction?
Yes. The injected script executes when a user views the lyrics for the maliciously tagged song.
What should be done if upgrading is not immediately possible?
Restrict song upload rights to trusted users and review uploaded songs' lyrics ID3 tags for HTML or script content. Remove or sanitize suspicious uploaded files before users view their lyrics.
How can administrators identify potentially affected content?
Inspect songs uploaded by users with upload rights, focusing on lyrics ID3 tags that contain HTML or script. Songs whose lyrics render unexpected markup or browser-executed content should be treated as suspicious.