Description
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | ampache | 3.6-rzb2752+dfsg-5+deb8u1 | DLA-1988-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ampache | 3.6-rzb2779+dfsg-0ubuntu9.2 | USN-4693-1 |
Advisories 2
- DLA-1988-1 ampache - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4693-1 ampache vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026