Swing Music’s /folder/dir-browser endpoint contains a directory traversal flaw in the list_folders() function that allows any authenticated user—including those without admin privileges—to enumerate and retrieve files from arbitrary directories on the server. This vulnerability is a classic path traversal (CWE‑25) coupled with an improper authorization mechanism (CWE‑284), enabling the disclosure of sensitive data that may include system files or other private host content. The ability to read arbitrary paths without needing elevated rights means the attack can be launched by a normal user account, potentially exposing confidential or proprietary information.

The affected software is Swing Music, a self-hosted music player maintained by swingmx. All versions prior to 2.1.4 are vulnerable; the fix was introduced in 2.1.4. Thus any deployment running Swing Music version 2.1.3 or earlier is at risk.

The CVSS v3.1 base score of 5.3 rates this issue as moderately severe. The EPSS score of less than 1 % indicates a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication but does not rely on excessive privileges, it is likely to be exercised by any user who gains valid credentials to the application. No known remote code execution vector is indicated, so the primary risk remains confidential data exposure.