AzuraCast EUVD-2026-115855

Requires an authenticated station user who holds the Media permission for the target station; the attacker submits formula-prefixed values (leading =, +, -, @, tab, or carriage return) in media titles, artists, albums, genres, lyrics, ISRC, extra metadata, or station custom fields through POST /api/station/{station_id}/files/bulk, and these are stored without spreadsheet-safe neutralization. Exploitation only realizes when a second authorized user subsequently exports the station's bulk media CSV via GET /api/station/{station_id}/files/bulk AND opens that file in a formula-evaluating spreadsheet application (e.g. Microsoft Excel) that permits formula execution. Limiting factors: authenticated low-privilege access is required (not unauthenticated), success depends on victim action (exporting and opening the CSV) and on the spreadsheet application's version and security settings, and the advisory explicitly disclaims server-side code execution, OS command execution, and execution within the AzuraCast process - impact is confined to the downstream spreadsheet environment.

This is a medium-severity (CVSS 4.0 base 5.1) stored CSV formula injection (CWE-1236) whose signals consistently point to a real-but-non-urgent issue rather than a high-impact priority. The CVSS 4.0 vector shows network delivery (AV:N) and low attack complexity (AC:L) but requires an authenticated station user holding the Media permission (PR:L) plus passive victim interaction (UI:P), and crucially records NO impact on the AzuraCast server itself (VC:N/VI:N/VA:N) - the only impact is on a subsequent system, the victim's spreadsheet application (SC:L/SI:L, SA:N). No EPSS score and no KEV status were provided in the input, so there is no probabilistic or confirmed-exploitation signal to raise urgency; absence of these is not evidence of safety but means widespread automated exploitation cannot be asserted. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the constrained preconditions. A public PoC reference exists (reproduction steps in the GHSA advisory) but the advisory explicitly states it was not dynamically reproduced and uses a benign payload, so it is not verified working exploit code. Net assessment: a legitimate defense-in-depth bug driven by an authenticated insider/compromised-account threat model with downstream spreadsheet impact - schedule the fix, but it is not a drop-everything network RCE despite the AV:N vector.

An authenticated station user holding the Media permission (e.g. 'mallory') uses the bulk media import endpoint POST /api/station/{station_id}/files/bulk to persist a formula-prefixed value (such as =1+1, or a more hostile external-reference formula) in a media title, artist, album, genre, lyrics, ISRC, or custom field. Later another authorized user ('alice') exports the station's bulk media CSV and opens it in Microsoft Excel or a similar formula-capable application, where the stored string is evaluated as a formula rather than shown as literal text. A public PoC reference with step-by-step reproduction exists in the GHSA advisory, though it was not dynamically reproduced and the payload is intentionally benign.