owncast_project 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk sql injection、vendor risk cross-site scripting, and vendor risk csrf に関連することが多く、vendor surface software deployment and vendor surface production workloads の文脈で ファイル上書き and vendor impact session compromise などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-31450 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can | [email protected] | 2.7 | 0.10% | 2024-04-19 | 2025-10-15 |
| CVE-2024-29026 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue. | [email protected] | 8.2 | 0.19% | 2024-03-20 | 2025-10-14 |
| CVE-2023-46480 | An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function. | [email protected] | 9.8 | 1.54% | 2023-11-27 | 2024-11-21 |
| CVE-2023-3188 | Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0. | [email protected] | 6.5 | 48.70% | 2023-06-10 | 2024-11-21 |
| CVE-2022-3751 | SQL Injection in GitHub repository owncast/owncast prior to 0.0.13. | [email protected] | 9.8 | 0.26% | 2022-11-29 | 2025-04-25 |
| CVE-2021-39183 | Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player. | [email protected] | 8.2 | 0.33% | 2021-12-14 | 2024-11-21 |