xiaomusic 0.5.7 Path Traversal via GET /music endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from sibling directories whose names share the music_path prefix by crafting traversal sequences, bypassing the path restriction due to the missing trailing separator in the comparison logic to retrieve arbitrary files from the server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | xiaomusic (PyPI) | before 0.5.8 | 0.5.8 | Patch available | GHSA-5j8p-5rrj-8wjg |
- xiaomusic (PyPI) Vendor— Affected before 0.5.8 Fixed in 0.5.8 Patch available GHSA-5j8p-5rrj-8wjg
Remediation
- Fix · GHSA-5j8p-5rrj-8wjg xiaomusic (PyPI) Fixed in 0.5.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10108
- 2026-10-03 Alias added: GHSA-5j8p-5rrj-8wjg
- 2026-10-14 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2026-10108 · CVE Program
- CVE-2026-10108 · NVD
- FIRST EPSS
- GHSA-5j8p-5rrj-8wjg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences