cve.bz

CVE-2026-25578

6.1 mediumEPSS 0.3%

Medium (6.1) in navidrome navidrome. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/navidrome/navidrome 0.60.0.

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in version 0.60.0.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-80
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rh3r-8pxm-hg4wGogithub.com/navidrome/navidrome<0.60.00.60.0
GO-2026-4413Gogithub.com/navidrome/navidrome<0.60.00.60.0

References

Check your stackJSON