What is the CVSS score of CVE-2026-67917?

CVE-2026-67917 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of AzuraCast are affected by CVE-2026-67917?

AzuraCast versions up to 0.23.7 contain a critical SQL injection vulnerability in the backup restore process that enables privilege escalation.

Is there a public PoC exploit available for CVE-2026-67917?

Yes, a public proof-of-concept exploit is available for CVE-2026-67917. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-67917?

Within 24 hours, restrict backup upload and restore permissions to only essential trusted administrators with documented approval requirements for all restore operations. Within 7 days, implement backup content validation procedures to inspect SQL syntax before execution, review backup and restore access logs for suspicious activity, and deploy monitoring for unauthorized restore attempts. Within 30 days, monitor AzuraCast release notes and security advisories for patch availability, develop and test upgrade procedures in a non-production environment, and implement additional logging to capture all database restore activities for compliance and audit purposes.

AzuraCast CVE-2026-67917

EUVD-2026-60535 CRITICAL

SQL Injection (CWE-89)

2026-08-17 mitre

GHSA-vm7q-56m8-9hgr

SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Restore is a privileged administrative command requiring attacker-controlled backup input, so AV:L and PR:H; injected SQL yields total impact hence C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 18:30 vuln.today

CVSS changed

Aug 18, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 17, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges

AnalysisAI

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privilege escalation because the azuracast:restore command runs the extracted db.sql file verbatim, with no content validation. The flaw carries a critical 9.8 CVSS from the reporter and has publicly available exploit code, though its EPSS probability is low (0.23%, 14th percentile) and it is not on CISA KEV. The real-world attack surface hinges on who can supply and trigger restoration of a crafted backup archive.

Technical ContextAI

AzuraCast is a self-hosted web radio and stream management suite (PHP application backed by a relational database, typically MariaDB/MySQL). The vulnerable component is the administrative maintenance tooling: the azuracast:restore CLI/console command unpacks a backup archive and pipes the contained db.sql dump directly into the database engine. The root cause is CWE-89 (SQL Injection) - untrusted SQL from the archive is executed as trusted database statements without sanitization, allowing arbitrary SQL (and therefore data manipulation, credential/permission changes, or privilege escalation) to run with the database service's rights. Note the CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and provides no usable version anchoring; identification relies entirely on the description.

RemediationAI

No vendor-released patched version is identified in the available data, so a specific fix version cannot be cited - monitor the AzuraCast project releases and changelog for a version above 0.23.7 that addresses backup-restore SQL handling, and upgrade once published. As compensating controls: restrict who can execute the azuracast:restore command to trusted operators only and treat it as a privileged operation (side effect: restore becomes an audited, manual step rather than self-service); only restore backup archives from sources whose integrity you can verify, and validate/inspect the db.sql contents before restoration (trade-off: manual review effort and slower recovery); store backups with integrity protection (checksums/signatures) so tampered archives are detectable; and isolate the database account used by AzuraCast to least privilege so an injected dump cannot reach beyond the application's schema. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-67917.