Xiaomusic version 0.5.7 contains an unauthenticated path traversal flaw in its GET /music/{file_path:path} endpoint. The vulnerability arises from an incomplete path prefix check, where the comparison logic overlooks the trailing separator. Attackers can craft traversal sequences that bypass the intended music directory restriction and read arbitrary files on the host. The consequences are loss of confidentiality, as sensitive files outside the music folder can be exposed to any user without authentication.

This weakness affects systems running the Xiaomusic application from the vendor hanxi, specifically version 0.5.7. No additional affected version information is supplied, so any deployment of this exact release is vulnerable.

The CVSS score of 8.7 indicates high severity. The EPSS score is not provided, but the flaw is known to be exploitable server‑side without authentication or special privileges. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP GET request sent to the /music endpoint, as the flaw does not require authentication or additional software installation.