CVE-2025-10669CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2025-10669

Medium · published September 18, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing manipulation results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-09-18T18:15Z
References (4)
https://github.com/mikecole-mg/security_findings/blob/main/airsonic-advanced/airsonic-rce.md · [email protected]https://vuldb.com/?ctiid.324790 · [email protected]https://vuldb.com/?id.324790 · [email protected]https://vuldb.com/?submit.652356 · [email protected]
EPSS history
Timeline
  • 18 SEP 13:32Z
    Airsonic-Advanced Playlist Upload unrestricted upload
    cvelistv5