CVE-2026-111925

Mopidy versions prior to 4.0.5 are vulnerable to a path traversal vulnerability in the File Backend library. The root cause is a missing containment check in the FileLibraryProvider.lookup() function. This flaw allows unauthenticated clients to access local files outside the designated file/media...