{"id":"CVE-2026-125395","kind":"vulnerability","aliases":["CVE-2026-125395"],"related":[],"title":"Ampache: song lyrics field lets uploaders run script in viewers' browsers","description":"Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.","summary":"Ampache before 8.4.0 does not escape song lyrics when it displays them, so HTML and script inside the lyrics are run by the browser. A user with upload rights can embed script in a song's lyrics ID3 tag, which then runs for anyone who views those lyrics.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ampache","package","php","self-hosted"],"not_affected_if":["no-untrusted-uploaders","version-8.4.0-or-later"],"how_to_check":"- Check the Ampache version in use; versions below `8.4.0` are affected.\n- Review whether untrusted users hold upload rights, since those users can plant the payload.","fix":"- Ampache: move to `8.4.0` or later, per the sources.","status":"open","published_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:30:24+00:00","updated_at":"2026-11-10T00:30:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T00:30:24Z","model":"claude-haiku-5-5","output":{"fix":"- Ampache: move to `8.4.0` or later, per the sources.","reach":"network","title":"Ampache: song lyrics field lets uploaders run script in viewers' browsers","impact":"medium","summary":"Ampache before 8.4.0 does not escape song lyrics when it displays them, so HTML and script inside the lyrics are run by the browser. A user with upload rights can embed script in a song's lyrics ID3 tag, which then runs for anyone who views those lyrics.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ampache","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in other users' browsers, enabling session theft","analyst_note":"","how_to_check":"- Check the Ampache version in use; versions below `8.4.0` are affected.\n- Review whether untrusted users hold upload rights, since those users can plant the payload.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.4.0-or-later","no-untrusted-uploaders"],"who_is_affected":"Ampache installs before 8.4.0 where users can upload songs. The payload is stored in the lyrics and runs for any user who opens the lyrics view, so exposure grows with the number of accounts that can view the library. Installs where only trusted administrators upload content carry less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4631,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125395':14A,17A '-2026':13A,16A '8.4.0':26B,74C 'allow':84C 'ampach':1A,18B,24B,72C 'anyon':67B 'attack':101C 'browser':11A,47B,119C 'code':116C 'contain':75C,110C 'cross':79C 'cross-sit':78C 'cve':12A,15A 'display':34B 'emb':54B 'escap':29B 'execut':115C 'field':4A 'getlyr':98C 'host':23B 'html':37B,111C 'id3':61B,108C 'inject':90C 'insid':40B 'let':5A 'lyric':3A,31B,42B,60B,71B,95C,107C,125C 'lyricsview.php':97C 'packag':19B 'php':20B 'right':52B,88C 'run':7A,44B,65B 'script':8A,39B,55B,81C,91C,113C 'self':22B 'self-host':21B 'show_lyrics.inc.php':100C 'site':80C 'song':2A,30B,58B,94C,105C 'store':77C 'tag':62B,109C 'unescap':93C 'upload':6A,51B,87C,103C 'user':49B,85C,122C 'view':69B,123C 'viewer':10A 'vulner':82C 'whose':106C","nicknames":[],"mitigations":[],"who_affected":"Ampache installs before 8.4.0 where users can upload songs. The payload is stored in the lyrics and runs for any user who opens the lyrics view, so exposure grows with the number of accounts that can view the library. Installs where only trusted administrators upload content carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ampache","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-125395':14A,17A '-2026':13A,16A 'ampach':1A 'browser':11A 'cve':12A,15A 'field':4A 'let':5A 'lyric':3A 'run':7A 'script':8A 'song':2A 'upload':6A 'viewer':10A","search_b":"'8.4.0':26B 'ampach':18B,24B 'anyon':67B 'browser':47B 'display':34B 'emb':54B 'escap':29B 'host':23B 'html':37B 'id3':61B 'insid':40B 'lyric':31B,42B,60B,71B 'packag':19B 'php':20B 'right':52B 'run':44B,65B 'script':39B,55B 'self':22B 'self-host':21B 'song':30B,58B 'tag':62B 'upload':51B 'user':49B 'view':69B","search_c":"'8.4.0':74C 'allow':84C 'ampach':72C 'attack':101C 'browser':119C 'code':116C 'contain':75C,110C 'cross':79C 'cross-sit':78C 'execut':115C 'getlyr':98C 'html':111C 'id3':108C 'inject':90C 'lyric':95C,107C,125C 'lyricsview.php':97C 'right':88C 'script':81C,91C,113C 'show_lyrics.inc.php':100C 'site':80C 'song':94C,105C 'store':77C 'tag':109C 'unescap':93C 'upload':87C,103C 'user':85C,122C 'view':123C 'vulner':82C 'whose':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125395","severity":null,"published_at":"2026-11-10T00:17:13+00:00","modified_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111588,"url":"https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111589,"url":"https://github.com/ampache/ampache/releases/tag/8.4.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111590,"url":"https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}