CVE-2026-25578: Navidrome is vulnerable to XSS via comment from song metadata
Vulnerability summary
CVE-2026-25578 is a medium (CVSS 6.1) vulnerability in navidrome. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 04-02-2026PublishedVulnerability first disclosed.
- 05-02-2026Last modifiedVulnerability information updated.
Description
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in version 0.60.0.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · GoEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNavidrome
Maturity: poc
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Affected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- navidrome< 0.60.0-r0
Github.com/navidrome1 product
- navidrome< 0.60.0
Navidrome1 product
- navidrome< 0.60.0
3 vendors · 3 products
References
6 links- github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4wX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/navidrome/navidrome/commit/d7ec7355c9036d5be659d6ac555c334bb5848ba6X Refsource MISCWEBFIXPatch
