CVE-2026-111925CWE-22path-traversal

CVE-2026-111925

Medium · published October 19, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-19T18:17Z
References (6)
https://www.vulncheck.com/advisories/mopidy-before-4.0.5-path-traversal-via-file-backend-library-lookup · [email protected]https://github.com/mopidy/mopidy/issues/2350 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/mopidy/mopidy/blob/v4.0.4/src/mopidy/_exts/file/library.py · [email protected]https://github.com/mopidy/mopidy/commit/f23c1f8621c3f4eb07a35d37fccb597449d36415 · [email protected]https://github.com/mopidy/mopidy/issues/2350 · [email protected]https://github.com/mopidy/mopidy/releases/tag/v4.0.5 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 13:55Z
    Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
    cvelistv5
  • 19 OCT 13:55Z
    Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
    cvelistv5