The vulnerability stems from insufficient sanitization of the currentDirectory parameter in AzuraCast’s media upload endpoint, a weakness that falls under CWE‑22 (Path Traversal). This allows an attacker to embed path‑traversal sequences and write files outside the intended media directory, including PHP web shells that grant remote code execution. An attacker who gains execution privileges has full control over the affected server.

AzuraCast installations running any version prior to 0.23.6 are vulnerable when using the default local filesystem storage backend. The attack requires a user with media‑management permissions to upload a file with a specially crafted currentDirectory value.

The CVSS score of 8.8 reflects high severity. The EPSS score is not available, so no current exploitation probability is reported. The vulnerability is not listed in CISA’s KEV catalog. The exploit necessitates authenticated access to the media upload function and a local storage configuration; once satisfied, an attacker can place malicious code in the web root and execute it.