{"id":"UBUNTU-CVE-2026-125395","details":"Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.","modified":"2026-11-11T09:39:23.147331635Z","published":"2026-11-10T00:00:00Z","upstream":["CVE-2026-125395"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-125395"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-125395"}],"affected":[{"package":{"name":"ampache","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/ampache?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6-rzb2779+dfsg-0ubuntu5","3.6-rzb2779+dfsg-0ubuntu6","3.6-rzb2779+dfsg-0ubuntu7","3.6-rzb2779+dfsg-0ubuntu8","3.6-rzb2779+dfsg-0ubuntu9","3.6-rzb2779+dfsg-0ubuntu9.1","3.6-rzb2779+dfsg-0ubuntu9.2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.6-rzb2779+dfsg-0ubuntu9.2","binary_name":"ampache"},{"binary_version":"3.6-rzb2779+dfsg-0ubuntu9.2","binary_name":"ampache-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-125395.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}