16 matches found
CVE-2026-111925
A flaw was found in Mopidy. A remote, unauthenticated attacker can access local files outside the configured media directories due to missing path containment checks in the file library component. By sending requests with manipulated file paths over network interfaces, an attacker can determine...
Linux Distros Unpatched Vulnerability : CVE-2026-111925
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because...
UBUNTU-CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
DEBIAN-CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
EUVD-2026-104317
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925
Mopidy versions prior to 4.0.5 are vulnerable to a path traversal vulnerability in the File Backend library. The root cause is a missing containment check in the FileLibraryProvider.lookup() function. This flaw allows unauthenticated clients to access local files outside the designated file/media...
CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
PT-2026-117396
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media dirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-111925: Improper Limitation of a Pathname to a Restricted Directory
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
Mopidy path traversal vulnerability
Mopidy versions prior to 4.0.5 have a path traversal vulnerability. This vulnerability stems from the lack of inclusion checks in the FileLibraryProvider.lookup function. As a result, unauthenticated attackers can use JSON-RPC or WebSocket to call core.library.lookup or core.tracklist.add, thereb...