CVE-2026-125395
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
References
- https://github.com/ampache/ampache
- https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70
- https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18
- https://github.com/ampache/ampache/releases/tag/8.4.0
- https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag