Music Player Daemon (MPD) versions prior to 0.24.11 have a path traversal flaw in the LocalStorage plugin where user‑supplied URIs are concatenated to the storage root without canonicalization, allowing an attacker to craft URIs containing '..' segments. The vulnerability permits an unauthenticated attacker to use the listfiles command to enumerate directory entries that the MPD process can read, and to use the albumart command to read image files from any directory outside the configured music_directory. The result is the ability to read arbitrary files, leading to confidential data disclosure. The CVSS score of 8.7 indicates a high risk and a low to moderate attack complexity, while the lack of authentication is a notable concern.

All users of MusicPlayerDaemon:MPD running releases before 0.24.11 are affected. The fix was introduced in version 0.24.11 (released in May 2026). Systems still running older versions that have the LocalStorage plugin enabled and that allow the listfiles or albumart commands are vulnerable, and the impact scope is limited to the filesystem permissions of the MPD process.

The vulnerability carries a high CVSS score of 8.7 and is not yet listed in CISA’s KEV, suggesting no widespread exploitation has been reported yet. EPSS data is unavailable, so the exact probability of exploitation is unknown. However, the attack path is straightforward: any local user or network client that can communicate with the MPD server and issue the listfiles or albumart commands can exploit it, regardless of the MPD process’s privileges, as the flaw relies on the process’s own file‑system access. Consequently, the risk remains significant for exposed MPD services.