CVE-2022-23857 - CVE House
Back to Database
Status published Medium CVE-2022-23857

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection...

Vulnerability Description

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23857

Credits & Attribution

No credits recorded in the NVD database.

References

More from navidrome

View All →
CVE-2025-48949
Navidrome allows SQL Injection via role parameter
High 8.9
CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
High 7.4
CVE-2025-27112
Navidrome has authentication bypass in Subsonic API with non-existent username
Medium 6.9
CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
High 7.1
CVE-2024-47062
Multiple SQL Injections and ORM Leak in navidrome
Critical 9.4

Affected Vendor

Affected Software

navidrome
Vulnerable Versions:
0

Timeline

Official Publish: January 24th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.