CVE-2026-49128 Details
Description
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.
A path traversal vulnerability has been identified in Music Player Daemon (MPD) versions prior to 0.24.11. The issue resides in the local storage plugin, specifically within the 'MapFSOrThrow' and 'MapUTF8' functions. The vulnerability arises because the on-disk path is created by concatenating the storage root with a user-supplied URI as plain strings, without proper canonicalization. This flaw allows '..' segments to persist in the resolved path, where they can be flattened by the kernel during file access operations. An unauthenticated attacker can exploit this vulnerability by using the 'listfiles' command to enumerate the names, sizes, and modification times of arbitrary directories accessible to the MPD process. Additionally, the 'albumart' command can be used to read image files from any chosen directory outside the configured music directory.
Users can upgrade to Music Player Daemon version 0.24.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MusicPlayerDaemon/MPD/issues/2484 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/MusicPlayerDaemon/MPD/commit/0b5315b9e5a42cb0e88bf46a7579bb5641543f60 | [email protected] | Source CodeVendor |
| https://github.com/MusicPlayerDaemon/MPD/issues/2484 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 | [email protected] | Release NotesVendor |
| https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html | [email protected] | |
| https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS | [email protected] | Release NotesVendor |
| https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/music-player-daemon-path-traversal-via-localstorage-uri-handling | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Music Player Daemon | < 0.24.11 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |