TI-2026-08861 CVE-2026-10108 · GHSA-5j8p-5rrj-8wjg
xiaomusic 0.5.7 Path Traversal via GET /music endpoint
Priority HIGH 77
xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by…