CVE-2026-125395 · Package
NO FIX YET · SEE WHAT TO DO
Ampache before 8.4.0 does not escape song lyrics when it displays them, so HTML and script inside the lyrics are run by the browser. A user with upload rights can embed script in a song's lyrics ID3 tag, which then runs for anyone who views those lyrics.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Ampache installs before 8.4.0 where users can upload songs. The payload is stored in the lyrics and runs for any user who opens the lyrics view, so exposure grows with the number of accounts that can view the library. Installs where only trusted administrators upload content carry less risk.
Not affected if no-untrusted-uploaders, version-8.4.0-or-later
Who cares ampache, php, self-hosted
8.4.0 are affected.8.4.0 or later, per the sources.Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.