CVE-2025-48949

Description

Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome

Affected packages (2)

• Go/github.com/navidrome/navidrome>= 0.55.0, < 0.56.0
• Go/github.com/navidrome/navidrome>= 0.55.0, < 0.56.0

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-48949
• PATCHhttps://github.com/navidrome/navidrome
• WEBhttps://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6
• WEBhttps://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r