Threats affecting pkg:github/azuracast/AzuraCast

CVE-2026-42605 is a path traversal vulnerability in AzuraCast versions prior to 0.23.6. It affects the Flow.js media upload endpoint, where the currentDirectory parameter is not properly sanitized. An authenticated user with media management permissions can exploit this to write arbitrary files outside the intended media storage directory, potentially leading to remote code execution by placing a PHP webshell in the web root. This vulnerability has been fixed in version 0.23.6.