CVE-2026-49339

🗓️ 19 Jun 2026 18:23:20Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

CVE-2026-49339 allows authenticated users to read or delete other users' playlists via path traversal in the playlist id.

Reporter	Title	Published	Views	Family All 21
attackerkb	CVE-2026-49339	19 Jun 202618:23	–	attackerkb
Circl	CVE-2026-49339	27 Jun 202600:35	–	circl
Cvelist	CVE-2026-49339 Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist	19 Jun 202618:23	–	cvelist
EUVD	EUVD-2026-38062	26 Jun 202623:32	–	euvd
Github Security Blog	gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists	26 Jun 202623:32	–	github
Mend	CVE-2026-49339	19 Jun 202618:23	–	mend
NVD	CVE-2026-49339	19 Jun 202619:16	–	nvd
osv_cve	CVE-2026-49339 Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist	19 Jun 202618:23	–	osv_cve
osv_ghsa	GHSA-2FP4-5V5C-4448 gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists	26 Jun 202623:32	–	osv_ghsa
osv_go	GO-2026-5825 gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic	7 Jul 202615:26	–	osv_go

[
  {
    "vendor": "sentriz",
    "product": "gonic",
    "versions": [
      {
        "version": "< 0.21.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/sentriz/gonic/commit/6dd71e6
github	www.github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445
github	www.github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448

Parameter	Position	Path	Description	CWE
id	path	/playlist/get	Path traversal in the 'id' parameter of the playlist get endpoint allows an authenticated user to bypass ownership checks and read other users' playlists or probe arbitrary files.	CWE-22, CWE-639
id	path	/playlist/delete	Path traversal in the 'id' parameter of the playlist delete endpoint allows an authenticated user to bypass ownership checks and delete other users' playlists.	CWE-22, CWE-639

23 Jun 2026 15:44Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.1

EPSS0.00388

SSVC