What is CVE-2026-67917?
A SQL injection vulnerability exists in the backup restore functionality of zuraCast versions up to and including 0.23.7, as the `azuracast:restore` command executes the `db.sql` file without validation. This allows a remote attacker to escalate privileges. Users should update to the latest version immediately.
Azərbaycanca: zuraCast-in 0.23.7 və əvvəlki versiyalarında backup bərpa funksiyasında SQL injection zəifliyi aşkarlanıb. Hücumçu `db.sql` faylı vasitəsilə uzaqdan əmrlər icra edə bilər. Dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Which versions of zuraCast are affected by CVE-2026-67917?
This SQL injection vulnerability affects zuraCast versions up to and including 0.23.7.
What can an attacker achieve by exploiting CVE-2026-67917?
An attacker can escalate privileges by remotely executing commands through the `db.sql` file.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.