CVE-2026-49128

HighCVSS 7.5

Published: 28/05/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

A path traversal vulnerability in MPD before version 0.24.11 allows an unauthenticated attacker to read files and directories outside the configured music_directory. The flaw exists in the local storage plugin where the path is constructed without canonicalization, allowing '..' sequences.

Risk Assessment

An attacker can use the listfiles and albumart commands to enumerate names, sizes, and modification times of arbitrary directories and read image files accessible by the MPD process, leading to disclosure of sensitive information.

Recommendation

Upgrade MPD to version 0.24.11 or later, which includes a fix for the path traversal vulnerability.

Other vulnerabilities in Music Player Daemon (MPD)

CVE-2026-49129Medium
SSRF vulnerability in MPD before 0.24.11 allows unauthenticated attackers to bypass HTTP/HTTPS scheme restrictions via redirects to protocols like gopher, ftp, or sftp. Using MPD commands that initiate URL fetches (e.g., add, albumart) enables interaction with internal or restricted network services.

Original NVD description (English source)

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.