AzuraCast versions before 0.23.8 have a server-side request forgery (SSRF) and local file read vulnerability in the AutoDJ remote playlist fetch functionality. A user with Media permission can craft a playlist referencing a file:// URL or internal HTTP endpoints, causing the backend to read local files or internal resources without proper restrictions. This can disclose sensitive files such as /etc/passwd or application environment files to users with Broadcasting permission. No patch was available at the time of publication.