The music/playlists/update API in Music Assistant allows unauthenticated network‑adjacent attackers to bypass the enforced file extension check for playlist files. By specifying arbitrary file paths, an attacker can overwrite any file on the host filesystem. Because the container runs as root, they can place a malicious .pth loader in the Python site‑packages directory, causing Python to execute arbitrary code when it loads. This vulnerability enables remote code execution with full host privileges.

Users running Music Assistant server versions 2.6.3 or earlier are affected. The issue was addressed in release 2.7.0, which removes the unsafe file‑write capability and tightens path validation and extension enforcement.

The CVSS score of 8.8 indicates high severity, while the EPSS score below 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by accessing the API endpoint without authentication, which is often exposed over local network connections. Because the container operates as root and the API performs unrestricted file writes, successful exploitation grants full control over the host system.