High severityNVD Advisory· Published May 30, 2025· Updated May 30, 2025
Navidrome allows SQL Injection via role parameter
CVE-2025-48949
Description
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/navidrome/navidromeGo | >= 0.55.0, < 0.56.0 | 0.56.0 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/navidrome/navidromepkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 0.55.0, < 0.56.0+ 1 more
- (no CPE)range: >= 0.55.0, < 0.56.0
- (no CPE)range: < 0.0.20250612T141001-1.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-5wgp-vjxm-3x2rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-48949ghsaADVISORY
- github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6ghsax_refsource_MISCWEB
- github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2rghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.