← Back to CVE Explorer

CVE-2026-49128

Full vulnerability record from the local CVENow database.

Description

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2026-05-28 20:16:26.547000
Last modified
2026-10-26 13:10:00.140000
View original CVE JSON 
{
  "id": "CVE-2026-49128",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-28T20:16:26.547",
  "lastModified": "2026-10-26T13:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory."
    },
    {
      "lang": "es",
      "value": "Music Player Daemon (MPD) anterior a la versión 0.24.11 contiene una vulnerabilidad de salto de ruta en LocalStorage::MapFSOrThrow y LocalStorage::MapUTF8 dentro del plugin de almacenamiento local, donde la ruta en disco se construye uniendo la raíz de almacenamiento con una URI proporcionada por el usuario como cadenas de texto sin formato sin canonicalización, permitiendo que los segmentos ’..’ sobrevivan en la ruta resuelta y sean aplanados por el kernel en el momento de openat(). Un atacante no autenticado puede explotar esta falla usando el comando listfiles para enumerar nombres, tamaños y tiempos de modificación de directorios arbitrarios legibles por el proceso MPD, y el comando albumart para leer archivos de imagen en cualquier directorio elegido por el atacante fuera del music_directory configurado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MusicPlayerDaemon",
          "product": "MPD",
          "defaultStatus": "affected",
          "repo": "https://github.com/MusicPlayerDaemon/MPD",
          "packageURL": "pkg:github/MusicPlayerDaemon/MPD",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.24.11",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-29T13:27:19.955254Z",
          "id": "CVE-2026-49128",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MusicPlayerDaemon/MPD/commit/0b5315b9e5a42cb0e88bf46a7579bb5641543f60",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MusicPlayerDaemon/MPD/issues/2484",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11",
      "source": "[email protected]"
    },
    {
      "url": "https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html",
      "source": "[email protected]"
    },
    {
      "url": "https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS",
      "source": "[email protected]"
    },
    {
      "url": "https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/music-player-daemon-path-traversal-via-localstorage-uri-handling",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MusicPlayerDaemon/MPD/issues/2484",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}