CVE-2026-125395 | BDVDB-2026-402639 Detail
ampacheampache
Description#
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18
- https://github.com/ampache/ampache
- https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70
- https://github.com/ampache/ampache/releases/tag/8.4.0
- https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.