CVE-2026-49128

Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

View on CVE.org
Published May 28, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.

Analysis

AI-generated

Technical impact

Music Player Daemon (MPD) versions prior to 0.24.11 have a path traversal flaw in the LocalStorage plugin where user‑supplied URIs are concatenated to the storage root without canonicalization, allowing an attacker to craft URIs containing '..' segments. The vulnerability permits an unauthenticated attacker to use the listfiles command to enumerate directory entries that the MPD process can read, and to use the albumart command to read image files from any directory outside the configured music_directory. The result is the ability to read arbitrary files, leading to confidential data disclosure. The CVSS score of 8.7 indicates a high risk and a low to moderate attack complexity, while the lack of authentication is a notable concern.

Affected Systems

All users of MusicPlayerDaemon:MPD running releases before 0.24.11 are affected. The fix was introduced in version 0.24.11 (released in May 2026). Systems still running older versions that have the LocalStorage plugin enabled and that allow the listfiles or albumart commands are vulnerable, and the impact scope is limited to the filesystem permissions of the MPD process.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.7 and is not yet listed in CISA’s KEV, suggesting no widespread exploitation has been reported yet. EPSS data is unavailable, so the exact probability of exploitation is unknown. However, the attack path is straightforward: any local user or network client that can communicate with the MPD server and issue the listfiles or albumart commands can exploit it, regardless of the MPD process’s privileges, as the flaw relies on the process’s own file‑system access. Consequently, the risk remains significant for exposed MPD services.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MPD to version 0.24.11 or later, where path canonicalization has been implemented.
  • Run the MPD process under a least‑privileged user that has no read access to sensitive parts of the filesystem.
  • Limit client access to the MPD server or disable the local‑storage plugin and the listfiles/albumart commands through configuration changes if an upgrade cannot be performed immediately.

Generated by OpenCVE AI on May 28, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Musicpd
Musicpd music Player Daemon
CPEs cpe:2.3:a:musicpd:music_player_daemon:*:*:*:*:*:*:*:*
Vendors & Products Musicpd
Musicpd music Player Daemon
Type Values Removed Values Added
First Time appeared Musicplayerdaemon
Musicplayerdaemon mpd
Vendors & Products Musicplayerdaemon
Musicplayerdaemon mpd
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.
Title Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 8, 2026, 2:04 PM
Reserved
May 27, 2026, 5:40 PM

View source JSON

Updated
May 29, 2026, 1:25 PM

JSON

Status
Deferred
Published
May 28, 2026, 8:16 PM
Modified
Oct 26, 2026, 1:10 PM

View source JSON

No data.

Updated
May 29, 2026, 3:47 PM

JSON