CVE-2026-118577

MediumCVSS 6.3

Published: 28/10/2026(UTC)Updated: 03/11/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability was identified in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation leads to server-side request forgery, and remote exploitation is possible. The exploit is publicly available and might be used; the patch identifier is b0d3876247a0a64fa0e430e4b21870e41f503182.

Risk Assessment

A remote attacker could force the application to make requests to internal resources, potentially leading to information disclosure or access to internal services. The public availability of the exploit increases the risk.

Recommendation

Apply the patch with identifier b0d3876247a0a64fa0e430e4b21870e41f503182. Until updated, restrict network access to MusicFreeDesktop.

Other vulnerabilities in MusicFreeDesktop

CVE-2026-118578Medium
A security flaw was discovered in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation results in information disclosure, and the attack can only be performed from the local network. The exploit has been publicly released and may be used for attacks, and the project was informed early via an issue report but has not responded yet.

Original NVD description (English source)

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS