Read the docs
TI-2026-36517 Aliases CVE-2026-49339GHSA-2fp4-5v5c-4448

Path traversal in sentriz gonic

Priority MEDIUM 64CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed gonic (sentriz): 0.21.0go.senan.xyz/gonic (Go): 0.21.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sentrizgonicbefore 0.21.00.21.0Patch availableCNA
—go.senan.xyz/gonic (Go)before 0.21.00.21.0Patch availableGHSA-2fp4-5v5c-4448
  • gonic Vendorsentriz Affected before 0.21.0 Fixed in 0.21.0 Patch available CNA
  • go.senan.xyz/gonic (Go) Vendor— Affected before 0.21.0 Fixed in 0.21.0 Patch available GHSA-2fp4-5v5c-4448

Remediation

  • Fix · CNA gonic (sentriz) Fixed in 0.21.0
  • Fix · GHSA-2fp4-5v5c-4448 go.senan.xyz/gonic (Go) Fixed in 0.21.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49339
  2. 2026-10-03 Alias added: GHSA-2fp4-5v5c-4448

References

Advisory 1

Other 4

  • TI-2026-36518 Path traversal in sentriz gonic CVSS 3.1HIGH 8.1
  • TI-2026-36516 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) CVSS 3.1HIGH 7.1
  • TI-2026-58917 gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences