There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Navidrome is an open source web-based music collection server and streamer. A permission verification flaw
    in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and
    perform administrator-only transcoding configuration operations, including creating, modifying, and
    deleting transcoding settings. In the threat model where administrators are trusted but regular users are
    not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0
    patches the issue. (CVE-2025-48948)

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2
    have a vulnerability due to improper input validation on the `role` parameter within the API endpoint
    `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining
    unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0
    contains a patch for the issue. (CVE-2025-48949)

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、fc2d2fb8-4c83-11f0-8deb-f8f21e52f724 のアドバイザリに記載されている脆弱性の影響を受けます。

    Deluan による報告
    この脆弱性は、API エンドポイント /api/artist 内のロールパラメーターの入力検証が不適切なために発生します。攻撃者がこの欠陥を悪用して、任意のSQLクエリを挿入し、バックエンドデータベースへの認証されていないアクセスを取得し、ユーザーの秘密情報を危険にさらす可能性があります。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fc2d2fb8-4c83-11f0-8deb-f8f21e52f724 advisory.

    Deluan reports:
    This vulnerability arises due to improper input validation on the role parameter within the API endpoint     /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining     unauthorized access to the backend database and compromising sensitive user information.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/12/4	2026/7/2	critical
436225	Alpine: multiple navidrome packages: security update to 0.56.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/12/4	2026/7/2	critical
434771	SCA: security update for github.com/navidrome/navidrome (GHSA-5wgp-vjxm-3x2r)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/2	critical
434771	SCA: security update for github.com/navidrome/navidrome (GHSA-5wgp-vjxm-3x2r)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/2	critical
240188	FreeBSDNavidrome -- ロールパラメーターを通じた SQL インジェクションfc2d2fb8-4c83-11f0-8deb-f8f21e52f724	Nessus	FreeBSD Local Security Checks	2025/6/19	2025/6/19	critical
240188	FreeBSD : Navidrome -- SQL Injection via role parameter (fc2d2fb8-4c83-11f0-8deb-f8f21e52f724)	Nessus	FreeBSD Local Security Checks	2025/6/19	2025/6/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical