8.8
CVE-2026-26975
- EPSS 1.45%
- Veröffentlicht 20.02.2026 00:49:03
- Zuletzt bearbeitet 17.03.2026 21:03:07
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginMusic Assistant Server Path Traversal in Playlist Update API Allows Remote Code Execution
Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass the .m3u extension enforcement and write files anywhere on the filesystem, which is exacerbated by the container running as root. This can be exploited to achieve Remote Code Execution by writing a malicious .pth file to the Python site-packages directory, which will execute arbitrary commands when Python loads. This issue has been fixed in version 2.7.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Music-assistant ≫ Music Assistant Server Version < 2.7.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.45% | 0.699 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-73 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
https://github.com/music-assistant/server/security/advisories/GHSA-7jcc-p6xr-835j
https://github.com/music-assistant/server/pull/2684
https://github.com/music-assistant/server/releases/tag/2.7.0