Navidrome
9 CVEs across 1 Navidrome products. Browse Navidrome vulnerabilities, severities, and proof-of-concept exploits.
Navidrome products with known CVEs
Navidrome CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-25579 | Medium | 6.5 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supp… |
CVE-2026-25578 | Medium | 6.1 | 2026-02-04 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allow… |
CVE-2025-48949 | Critical | 9.8 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validatio… |
CVE-2025-48948 | Medium | 6.5 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated… |
CVE-2025-27112 | Medium | 6.5 | 2025-02-24 | Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API end… |
CVE-2024-56362 | High | 7.1 | 2024-12-23 | Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file unde… |
CVE-2024-47062 | High | 8.8 | 2024-09-20 | Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be expl… |
CVE-2024-41259 | Critical | 9.1 | 2024-08-01 | Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information. |
CVE-2024-32963 | Medium | 4.2 | 2024-05-01 | Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerabilit… |
CVE-2023-51442 | High | 8.6 | 2023-12-21 | Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allo… |
CVE-2022-23857 | Medium | 6.5 | 2022-01-24 | model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user cou… |