Which versions of Navidrome are affected by CVE-2025-48949?

Organizations using Navidrome face significant risk from CVE-2025-48949, a SQL injection vulnerability rated CVSS 8.9.. A patch is available.

How to fix or mitigate CVE-2025-48949?

Within 30 days: Identify all affected systems and apply vendor patches as part of regular patch cycle. Validate that input sanitization is in place for all user-controlled parameters.

Navidrome CVE-2025-48949

Q: What is the CVSS score of CVE-2025-48949?

CVE-2025-48949 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

HIGH

SQL Injection (CWE-89)

2025-05-30 security-advisories@github.com

Authentication Bypass SQLi Navidrome Suse

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:44 vuln.today

Patch released

Mar 28, 2026 - 18:44 nvd

Patch available

CVE Published

May 30, 2025 - 20:15 nvd

HIGH 8.9

DescriptionGitHub Advisory

Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.

AnalysisAI

Navidrome is an open source web-based music collection server and streamer. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue. Affected products include: Navidrome. Version information: through 0.55.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Navidrome

View all

CVE-2025-27112 MEDIUM This Month POC

6.9 Feb 24

Navidrome is an open source web-based music collection server and streamer. Rated medium severity (CVSS 6.9), this vulne

CVE-2024-47062 CRITICAL Act Now POC

9.4 Sep 20

Navidrome is an open source web-based music collection server and streamer. Rated critical severity (CVSS 9.4), this vul

CVE-2023-51442 HIGH This Week POC

8.6 Dec 21

Navidrome is an open source web-based music collection server and streamer. Rated high severity (CVSS 8.6), this vulnera

CVE-2026-25579 MEDIUM This Month POC

6.5 Feb 04

Navidrome versions prior to 0.60.0 allow authenticated users to trigger denial of service by requesting image resizing w

CVE-2026-25578 MEDIUM This Month POC

6.1 Feb 04

Navidrome versions before 0.60.0 contain a stored cross-site scripting vulnerability in song comment metadata that allow

CVE-2024-41259 CRITICAL Act Now

9.1 Aug 01

Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's

CVE-2024-32963 MEDIUM This Month POC

4.2 May 01

Navidrome is an open source web-based music collection server and streamer. Rated medium severity (CVSS 4.2), this vulne

CVE-2024-56362 MEDIUM This Month

5.5 Dec 23

Navidrome is an open source web-based music collection server and streamer. Rated medium severity (CVSS 5.5), this vulne

CVE-2025-48948 HIGH This Month POC

7.4 May 30

Navidrome is an open source web-based music collection server and streamer. Rated high severity (CVSS 7.4), this vulnera

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-48949 vulnerability details – vuln.today

Back

Navidrome CVE-2025-48949

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Navidrome

Same weakness CWE-89 – SQL Injection

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code