AzuraCast versions before 0.23.8 allow a user with station Media permission to supply an arbitrary remote URL for a playlist. The backend then passes that URL directly to PHP's file_get_contents without validating the scheme or restricting access to local or internal networks. This enables Server‑Side Request Forgery that can read local files via file:// URLs or fetch data from loopback or link‑local HTTP endpoints. The retrieved data is parsed as playlist entries, stored in StationQueue.autodj_custom_uri, and returned to any user with Broadcasting permission, exposing sensitive host files such as /etc/passwd or application environment files. The vulnerability is a typical instance of CWE-918.

All deployments of AzuraCast prior to version 0.23.8 are affected. The flaw resides in the AutoDJ remote playlist fetch located at backend/src/Radio/AutoDJ/QueueBuilder.php. It applies to installations that use the default Docker image configuration, where PHP allow_url_fopen is enabled and no internal URL restrictions are applied. Only users with station Media permission can create or edit remote playlists, while any user with Broadcasting permission can read the leaked data.

The CVSS v3 score of 4.8 signals moderate risk. No EPSS data is available, so current exploitation likelihood is unknown. The vulnerability was not listed in the CISA KEV catalog. The attack vector is user‑supplied input in the playlist; an attacker must have Media permissions to inject a malicious URL, and any Broadcasting user can retrieve the exposed content. Because the data returned is local to the host, the potential damage is limited but poses confidentiality risk for local files and internal services.