CVE-2026-100852

Summary

This vulnerability allows authenticated users with Streamers and Profile permissions to inject shell commands, leading to potential command execution as the Liquidsoap process user.

Exploitability

Exploitation requires the user to have Streamers and Profile permissions and to set a username containing shell metacharacters. The vulnerability is relatively easy to exploit given the required permissions.

Blast radius

If exploited, this could lead to full control over the Liquidsoap process, potentially allowing attackers to disrupt the service or execute arbitrary commands.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AzuraCast 0.23.8 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.