CVE-2026-67917: AzuraCast SQLi Vulnerability in Backup

CVE-2026-67917 Overview

CVE-2026-67917 is a SQL injection vulnerability in AzuraCast versions up to and including 0.23.7. The flaw resides in the backup restore functionality, specifically the azuracast:restore command. This command executes the db.sql file extracted from a backup archive without validating or sanitizing its contents. A remote attacker who can supply a malicious backup archive can execute arbitrary SQL statements against the underlying database. Successful exploitation allows privilege escalation and full compromise of application data. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers can achieve privilege escalation and full database compromise by supplying a crafted backup archive to the AzuraCast restore process.

Affected Products

AzuraCast versions 0.0 through 0.23.7
AzuraCast backup restore functionality (azuracast:restore command)
Any AzuraCast deployment where restore operations can be invoked with attacker-supplied archives

Discovery Timeline

2026-08-17 - CVE-2026-67917 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-67917

Vulnerability Analysis

AzuraCast is a self-hosted web radio management platform. The azuracast:restore command is designed to reconstruct an installation from a previously generated backup archive. During restore, the command extracts the archive and executes the embedded db.sql file directly against the application database. The restore workflow trusts the archive contents implicitly and performs no schema validation, no statement filtering, and no privilege segregation. An attacker able to deliver a crafted archive controls the SQL that runs, enabling arbitrary data manipulation and application-level privilege escalation.

Root Cause

The root cause is missing input validation on the db.sql payload consumed by the restore process. Backup archives are treated as trusted despite being externally sourced. Because the SQL statements execute with the privileges of the AzuraCast database user, an attacker can rewrite user records, insert administrative accounts, or drop and recreate tables. This maps to CWE-89, where untrusted input reaches the SQL interpreter without neutralization.

Attack Vector

The attack is network-reachable and requires no authentication when restore functionality is exposed. An attacker crafts a backup archive containing a malicious db.sql file. When the archive is processed by azuracast:restore, the embedded SQL executes. Public proof-of-concept material is available in a GitHub SQL Injection PoC repository referenced by the advisory. No verified exploit code is reproduced here; refer to the linked repository for technical details of the payload structure.

Detection Methods for CVE-2026-67917

Indicators of Compromise

Unexpected invocations of the azuracast:restore command in application or shell history logs.
New administrator accounts or modified role assignments in the AzuraCast users and roles tables without corresponding UI activity.
Backup archive files with unusual sizes, timestamps, or origin paths staged in the AzuraCast working directory.
Database audit entries showing schema modifications (CREATE, DROP, ALTER) outside of scheduled maintenance windows.

Detection Strategies

Monitor process execution for php invocations that include azuracast:restore as an argument and correlate against approved change tickets.
Enable database query logging and alert on INSERT or UPDATE statements targeting the users table when the source process is the restore command.
Compare current administrative account inventories against a known-good baseline on a scheduled basis.

Monitoring Recommendations

Ingest AzuraCast application and MariaDB/MySQL logs into a centralized analytics pipeline for correlation.
Alert on file system writes to the backup staging directory by non-service accounts.
Track outbound authentication events from AzuraCast hosts to identify post-exploitation lateral movement.

How to Mitigate CVE-2026-67917

Immediate Actions Required

Restrict access to the AzuraCast host and CLI to trusted administrators only until a patched release is applied.
Disable or gate the azuracast:restore workflow so it cannot be invoked with externally sourced archives.
Validate the integrity and provenance of any backup archive before restoration using cryptographic signatures or checksums.
Audit existing user, role, and permission tables for unauthorized modifications introduced by prior restore operations.

Patch Information

No vendor advisory URL is listed in the NVD record at the time of publication. Administrators should track the AzuraCast project release notes for a fixed version beyond 0.23.7 and apply the update once available. Consult the GitHub SQL Injection PoC reference for context on the vulnerable code path.

Workarounds

Perform restore operations only from backup archives generated by the same AzuraCast instance and stored in access-controlled locations.
Run the AzuraCast database user with the minimum privileges required for application operation, avoiding blanket GRANT ALL assignments.
Isolate the restore workflow to a maintenance host that is network-segmented from production users.

bash

# Configuration example: restrict backup directory permissions and database privileges
chown -R azuracast:azuracast /var/azuracast/backups
chmod 700 /var/azuracast/backups

# Grant only required privileges to the AzuraCast DB user
mysql -u root -p -e "REVOKE ALL PRIVILEGES ON *.* FROM 'azuracast'@'localhost'; \
  GRANT SELECT, INSERT, UPDATE, DELETE ON azuracast.* TO 'azuracast'@'localhost'; \
  FLUSH PRIVILEGES;"