navidrome — Vulnerabilities & Security Advisories 9

Navidrome serves as a self-hosted music server and streamer, enabling users to manage and access personal music collections. Historically, it has faced vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, with nine CVEs documented. Security concerns often stem from improper input validation and access control issues. While no major public incidents have been widely reported, the project maintains a moderate security posture due to its open-source nature and community-driven development. Regular updates address discovered vulnerabilities, though users should remain vigilant about applying patches promptly to mitigate potential risks associated with its web interface and API endpoints.