Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-125395

Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ampache ampache

Default version status: unaffected

  • 0 to < 8.4.0affected

References