MEDIUM 5.1 NVD
CVE-2026-125395
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
References
- https://github.com/ampache/ampache
- https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70
- https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18
- https://github.com/ampache/ampache/releases/tag/8.4.0
- https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-t
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.