CVE-2026-49340 Details
Description
gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with `0o777` permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in `Store.Write`. Version 0.21.0 patches the issue.
A logic error in Gonic's playlist handling function allows any authenticated Subsonic user, including non-admins, to write playlist M3U data to an attacker-controlled absolute filesystem path on the Gonic host. This vulnerability, present in versions through 0.20.1, also enables the creation of intermediate directories with world-writable permissions. The issue arises from an unreachable guard clause and a lack of path containment in the application's file writing process, allowing unauthorized file overwrites.
Users can update to Gonic version 0.21.0, which addresses this vulnerability by fixing the logic error and implementing proper path containment in the file writing process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-697 | Incorrect Comparison | [email protected] |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gonic | <= 0.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |