Critical severity9.8NVD Advisory· Published May 30, 2025· Updated Jun 17, 2026
CVE-2025-48949
CVE-2025-48949
Description
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/navidrome/navidromeGo | >= 0.55.0, < 0.56.0 | 0.56.0 |
Affected products
4- ghsa-coords2 versionspkg:golang/github.com/navidrome/navidromepkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 0.55.0, < 0.56.0+ 1 more
- (no CPE)range: >= 0.55.0, < 0.56.0
- (no CPE)range: < 0.0.20250612T141001-1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.