Mopidy versions earlier than 4.0.5 contain a path traversal flaw in the FileLibraryProvider.lookup function, which fails to enforce containment checks on the requested file URI. The vulnerability allows any unauthenticated client to craft a file:// URI containing directory traversal sequences and send it via core.library.lookup or core.tracklist.add over JSON‑RPC or WebSocket. Successful exploitation lets the attacker confirm the existence of arbitrary local files, read tag metadata, and trigger playback of out‑of‑sandbox media, thereby compromising file confidentiality and potentially allowing media exploitation.

The flaw affects all Mopidy installations running any version prior to 4.0.5. No specific media directory constraints are listed; the issue applies to all configured media_dirs.

The CVSS score of 6.9 indicates a moderate threat level. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting a lower priority for immediate exploitation, but the attack is straightforward and does not require elevated privileges. An attacker only needs network access to the JSON‑RPC or WebSocket interfaces to send a malicious lookup request.