Skip to content
OpenAdvisories

Package · Go

github.com/navidrome/navidrome

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-25578

    Navidrome is vulnerable to XSS via comment from song metadata

    Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user cred…

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • Medium 6.9
    CVE-2025-27112

    Navidrome has authentication bypass in Subsonic API with non-existent username

    Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary usern…

    navidrome navidrome github.com/navidrome/navidrome Go
  • Medium 4.2
    CVE-2024-32963

    Parameter Tampering vulnerability in Navidrome

    Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacke…

    navidrome navidrome github.com/navidrome/navidrome Go
  • Medium —
    CVE-2022-23857

    SQL injection in github.com/navidrome/navidrome

    model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains …

    github.com/navidrome/navidrome navidrome Alpine Go