Vulnerability Description
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a station's operations can craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station. In order to carry out an attack, a malicious user would need to know a valid SFTP station username and the coordinating internal filesystem structure. This issue is fixed in version 0.23.2.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Azuracast | Azuracast | < 0.23.2 |
Related Weaknesses (CWE)
References
- https://github.com/AzuraCast/AzuraCast/commit/34620dbad93f6cd8e209a4220e3e53c7c5Patch
- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-9449-rphm-mjqrExploitVendor Advisory
FAQ
What is CVE-2025-67737?
CVE-2025-67737 is a vulnerability with a CVSS score of 3.1 (LOW). AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the ...
How severe is CVE-2025-67737?
CVE-2025-67737 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67737?
Check the references section above for vendor advisories and patch information. Affected products include: Azuracast Azuracast.