CVE-2022-23857
SQL injection in github.com/navidrome/navidrome
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
CVE-2022-23857- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
CVE-2022-23857- Updated
- 2026-11-02
EUVDEUVD-2022-0665 No score
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
EUVD-2022-0665- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pmcr-2rhp-36hr No score
SQL injection in github.com/navidrome/navidrome
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
GHSA-pmcr-2rhp-36hr- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-23857
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
ALPINE-CVE-2022-23857- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV No score
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
CVE-2022-23857- Updated
- 2026-11-02
OSVGHSA-pmcr-2rhp-36hr No score
SQL injection in github.com/navidrome/navidrome
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
- Record
GHSA-pmcr-2rhp-36hr- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGO-2022-0302 No score
SQL injection in github.com/navidrome/navidrome
SQL injection in github.com/navidrome/navidrome
- Record
GO-2022-0302- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/navidrome/navidromeGo |
before 0.47.5 | 0.47.5 |
navidromeAlpine:v3.19 |
before 0.47.5-r0 | 0.47.5-r0 |
navidromeAlpine:v3.20 |
before 0.47.5-r0 | 0.47.5-r0 |
navidromeAlpine:v3.21 |
before 0.47.5-r0 | 0.47.5-r0 |
navidromeAlpine:v3.22 |
before 0.47.5-r0 | 0.47.5-r0 |
navidromeAlpine:v3.23 |
before 0.47.5-r0 | 0.47.5-r0 |
navidromeAlpine:v3.24 |
before 0.47.5-r0 | 0.47.5-r0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23857 is a medium vulnerability (CVSS 6.5) in Navidrome, published January 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in github.com/navidrome/navidrome 0.47.5.
References
github.com/navidrome/navidrome/releases/tag/v0.47.5
nvd.nist.gov/vuln/detail/CVE-2022-23857
security.alpinelinux.org/vuln/CVE-2022-23857