QSearchQSearch

CVE-2026-40089

9.9 CRITICAL

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming

Published: 2026-04-09 · Last updated: 2026-06-02

Severity and scoring

CVSS
9.9 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CWE
CWE-918

Affected products

VendorProduct
sonicverseradio_audio_streaming_stack

Description

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). Installations created using the provided install.sh script (including the one‑liner bash <(curl -fsSL https://sonicverse.short.gy/install-audiostack)) are affected. In these deployments, the dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without sufficient validation. An authenticated operator can abuse this to make arbitrary HTTP requests from the dashboard backend to internal or external systems. This vulnerability is fixed with commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-53827 — OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata ... (6.5 MEDIUM)
  • CVE-2026-47268 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (6.4 MEDIUM)
  • CVE-2026-46717 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (7.7 HIGH)
  • CVE-2026-53607 — ApostropheCMS is an open-source Node.js content management system (3.7 LOW)
  • CVE-2026-45012 — ApostropheCMS is an open-source Node.js content management system (7.6 HIGH)