CVE-2025-48949

HIGH EPSS 34.0%
Published May 30, 20251y ago · Modified Jun 17, 20262w ago
8.9 CVSS 4.0
High
Find Similar
Published May 30, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.

CVSS Details

Base Score
8.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
34.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
navidromenavidrome*≥0.55.0  –  <0.56.0

References 2

  • github.com https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6
    Patch
  • github.com https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r
    Vendor Advisory

Remediation

  • github.com https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6
    Patch