Music Player Daemon (MPD) contains a server‑side request forgery flaw in the CurlInputPlugin. Because the code sets CURLOPT_FOLLOWLOCATION without configuring CURLOPT_REDIR_PROTOCOLS_STR, an attacker can cause the MPD server to follow redirects to protocols other than http/https, such as gopher, ftp, sftp, ldap, dict, rtmp or rtsp. This permits unauthenticated users to direct the MPD server to access internal or restricted services, potentially leaking confidential data or enabling further lateral movement. The weakness is a classic SSRF (CWE‑918) with medium severity (CVSS 6.9).

All instances of Music Player Daemon running a version earlier than 0.24.11 are affected. The vulnerability is relevant when the MPD server uses libcurl prior to version 7.85.0, as older libcurl implementations lack the necessary protocol‑restriction controls. Users running MPD on any platform that exposes the standard MPD control interface to the local or network hosts are at risk.

The flaw can be triggered via MPD commands that initiate URL fetches—add, readcomments, albumart, readpicture, or load—without requiring administrative credentials. The attacker only needs the ability to issue MPD commands, which is typically possible from any machine that can communicate with the MPD control socket or TCP port. Although EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the medium CVSS score and the ability to reach internal services mean the exploitation risk is notable. The impact is confined to the MPD server host and any services reachable from it, but could enable enumeration of internal hosts or extraction of sensitive files if the target services are poorly protected.