Skip to content
OpenAdvisories

Package · Go

github.com/navidrome/navidrome

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-25579

    Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

    Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/…

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • Critical 9.4
    CVE-2024-47062 Public exploit Scanner template

    Multiple SQL Injections and ORM Leak in navidrome

    Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furtherm…

    navidrome navidrome github.com/navidrome/navidrome Go
  • Critical 9.1
    CVE-2024-41259

    Navidrome uses MD5 hashing algorithm

    Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.

    github.com/navidrome/navidrome Go