CVE-2024-47062

CVE-2024-47062 is a critical SQL Injection vulnerability affecting Navidrome versions prior to 0.53.0. It allows authenticated attackers to inject arbitrary SQL code by manipulating URL parameters, leading to information leakage, database content dumping, and potential password brute-forcing. With a CVSS score of 8.8 (HIGH), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not currently on the KEV catalog or showing active exploitation, a Nuclei template for authenticated SQL injection exists, and its high EPSS score indicates a significant likelihood of future exploitation. Community discussion and media coverage are currently minimal.