TI-2026-19235 Aliases CVE-2026-23877 GHSA-pj88-9xww-gxmh

Directory Traversal & Filesystem can be accessed by a non-admin user

LOW 25CWE-25Published 2026-01-19 · Updated 2026-01-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00595 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed swingmusic (swingmx): 2.1.4swingmusic (PyPI): 2.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
swingmx	swingmusic	before 2.1.4	2.1.4	Patch available	CNA
—	swingmusic (PyPI)	before 2.1.4	2.1.4	Patch available	GHSA-pj88-9xww-gxmh

swingmusic Vendorswingmx Affected before 2.1.4 Fixed in 2.1.4 Patch available CNA
swingmusic (PyPI) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-pj88-9xww-gxmh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:swingmx:swing_music::::::::	before 2.1.4	Vulnerable	swingmx

cpe:2.3:a:swingmx:swing_music:*:*:*:*:*:*:*:* Versions before 2.1.4 Vulnerable ·swingmx

Remediation

Fix · CNA swingmusic (swingmx) Fixed in 2.1.4
Fix · GHSA-pj88-9xww-gxmh swingmusic (PyPI) Fixed in 2.1.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-23877
2026-10-03 Alias added: GHSA-pj88-9xww-gxmh

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences