GHSA-8q4f-r7f6-8g49MediumCVSS 5.4
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with...
🔗 CVE IDs covered (1)
📋 Description
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125395
- https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18
- https://github.com/ampache/ampache
- https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70
- https://github.com/ampache/ampache/releases/tag/8.4.0
- https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag
- https://github.com/advisories/GHSA-8q4f-r7f6-8g49