CVE-2026-111925 Details
Description
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
A path traversal vulnerability has been identified in Mopidy versions prior to 4.0.5. This vulnerability allows unauthenticated clients to access local files outside the designated media directories. The issue arises because the FileLibraryProvider's lookup method does not perform a proper containment check. Attackers can exploit this by sending file:// URIs through the JSON-RPC or WebSocket interfaces to check for file existence, read metadata tags, and play files that are out of the sandboxed environment.
Users can update to Mopidy version 4.0.5, which includes a fix for this vulnerability by adding the necessary containment check to the lookup method in the file library.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mopidy/mopidy/issues/2350 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mopidy/mopidy/blob/v4.0.4/src/mopidy/_exts/file/library.py | [email protected] | Source CodeVendor |
| https://github.com/mopidy/mopidy/commit/f23c1f8621c3f4eb07a35d37fccb597449d36415 | [email protected] | Source CodeVendor |
| https://github.com/mopidy/mopidy/issues/2350 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mopidy/mopidy/releases/tag/v4.0.5 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/mopidy-before-4.0.5-path-traversal-via-file-backend-library-lookup | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mopidy | >= 0, < 4.0.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |