CVE-2026-25578 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows…
Medium CVSS: 6.1

CVE-2026-25578

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in version 0.60.0.
Vendor
Navidrome
Product
Navidrome
CWE
CWE-79
Yayın Tarihi
2026-02-04 22:16:01
Güncelleme
2026-02-18 19:03:44
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Navidrome MEDIUM Navidrome 2026

Referanslar

https://github.com/navidrome/navidrome/commit/d7ec7355c9036d5be659d6ac555c334bb5848ba6 https://github.com/navidrome/navidrome/releases/tag/v0.60.0 https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w