CVE-2022-23857

—

CVSS 3.1

6.5 medium

EPSS

<1%p59

Published

Jan 24, 2022 (Jan 24, 2022)

Modified

Jun 17, 2026

Description

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Vendors: navidrome
Products: navidrome
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.