CVE-2026-49129

MediumCVSS 5.8

Published: 28/05/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

SSRF vulnerability in MPD before 0.24.11 allows unauthenticated attackers to bypass HTTP/HTTPS scheme restrictions via redirects to protocols like gopher, ftp, or sftp. Using MPD commands that initiate URL fetches (e.g., add, albumart) enables interaction with internal or restricted network services.

Risk Assessment

Attackers can access internal network resources, perform port scanning, or attack services not exposed externally, leading to data leakage or privilege escalation.

Recommendation

Immediately upgrade MPD to version 0.24.11 or later. If upgrade is not possible, restrict MPD access to trusted hosts and disable unnecessary URL-fetching commands.

Other vulnerabilities in Music Player Daemon (MPD)

CVE-2026-49128High
A path traversal vulnerability in MPD before version 0.24.11 allows an unauthenticated attacker to read files and directories outside the configured music_directory. The flaw exists in the local storage plugin where the path is constructed without canonicalization, allowing '..' sequences.

Original NVD description (English source)

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.