CVE-2025-48949 - CVE House
Back to Database
Status published High CVE-2025-48949

Navidrome allows SQL Injection via role parameter

Vulnerability Description

Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48949

Credits & Attribution

No credits recorded in the NVD database.

References

More from navidrome

View All →
CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
High 7.4
CVE-2025-27112
Navidrome has authentication bypass in Subsonic API with non-existent username
Medium 6.9
CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
High 7.1
CVE-2024-47062
Multiple SQL Injections and ORM Leak in navidrome
Critical 9.4
CVE-2024-32963
Parameter Tampering vulnerability in Navidrome
Medium 4.2

Affected Vendor

Affected Software

navidrome
Vulnerable Versions:
>= 0.55.0, < 0.56.0

Timeline

Official Publish: May 30th, 2025
Last Modified: May 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact