CVE-2025-10326 is a medium severity flaw in RPi-Jukebox-RFID up to 2.8.0, scored 6.3 by NVD. It allows OS command injection through the playlist argument of /htdocs/api/playlist/single.php. The record lists no fixed version, so restrict access to the affected page, review the code, and check the vendor for a patch.
What's affected
The record names RPi-Jukebox-RFID up to 2.8.0. The affected code is in /htdocs/api/playlist/single.php. The vulnerable input is the playlist parameter.
No fixed version appears in the record or in the reference pages I could read. Do not assume a later release is safe. Check the vendor or project page for a patched release, and if none exists, plan on mitigation or replacement. The same product has sibling reports with different entry points: CVE-2025-10327 and CVE-2025-10328. Fixing one endpoint does not fix the others.
The record says the exploit has been published and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
RPi-Jukebox-RFID is a Raspberry Pi jukebox controlled through a web app. Check the version on each Pi. If you installed from the project's git repository, run this in the install directory:
git describe --tags
The record covers versions up to and including 2.8.0. Next, check network reach. Open the jukebox web page from a device outside the Pi's local network. If it loads, anyone who can reach that address can reach the API. Applications like this are usually installed by copying source files to a server, so no package manager records them and a dependency scan may not list them. Gold's free in-browser dependency scan still covers the libraries that sit next to them, and your own asset list is the place to find the application itself.
Finally, look at the code on the device. Search for the file and the argument:
grep -n "playlist" /path/to/htdocs/api/playlist/single.php
If the value is placed inside a shell command string, the page is affected.
What to do now
- Find every jukebox install, including old ones in shared spaces or on guest networks.
- Keep the web interface off the internet. Do not forward its port on your router.
- Limit access to trusted devices, for example with firewall rules on the Pi or the network.
- Check the project's repository and releases for a version after 2.8.0 that addresses the issue. The record says the vendor did not respond, so none may exist.
- If you maintain a fork, stop passing the playlist value into shell commands. Pass arguments as a list without a shell, and check them against a fixed pattern.
- If the Pi shares a network with anything sensitive, move it to its own segment.
Why it matters
This is command injection, listed under CWE-77 (command injection), CWE-78 (OS command injection). The page takes the playlist value from a request and places it inside a command that the Pi runs. If the value is not cleaned, extra text in it can be read by the shell as further commands. The web server user then runs them.
A home project with a web page looks harmless, but a Pi on your network can reach everything else on it. The weakness is not unusual: it is the standard mistake of building a command from strings. The same pattern appears in CVE-2025-10327 and CVE-2025-10328, each through a different file. The score of 6.3 reflects remote reach, low complexity and low privileges required, with low impact ratings in the vector. A shell on a Pi can matter more than those ratings suggest.
Quick check
Do I need to patch if the jukebox is only on my home network?
Lower risk, not zero. Any device on that network, including a compromised phone or laptop, can reach it. Limit access anyway.
Where is the fix?
The record lists none. Check the project's repository and releases, and apply mitigation if nothing newer than 2.8.0 addresses it.
Sources
Last reviewed: 19 October 2026.
