Medium severity5.4NVD Advisory· Published Nov 10, 2026

CVE-2026-125395

Description

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ampache/Ampachellm-fuzzy
Range: <8.4.0

Patches

Vulnerability mechanics

References

github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.phpnvd
github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18nvd
github.com/ampache/ampache/releases/tag/8.4.0nvd
www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tagnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000