p PatchFirst

CVE-2026-111925

CVE-2026-111925 · Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mopidy

    Versions
    • ≥ 0, < 4.0.5: Affected (semver)

    Update to 4.0.5

  • mopidy Debian:12

    Versions
    • 3.4.1-1
    • 3.4.2-1
    • 3.4.2-2
    • 3.4.2-3
    • 3.4.2-4
    • 3.4.2-5
    • 3.4.2-6
    • 3.4.2-7
    • 3.4.2-8
    • 4.0.3-1
    • 4.0.4-1
    • 4.0.4-2
    • 4.0.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Debian:13

    Versions
    • 3.4.2-3
    • 3.4.2-4
    • 3.4.2-5
    • 3.4.2-6
    • 3.4.2-7
    • 3.4.2-8
    • 4.0.3-1
    • 4.0.4-1
    • 4.0.4-2
    • 4.0.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Debian:14

    Versions
    • 3.4.2-3
    • 3.4.2-4
    • 3.4.2-5
    • 3.4.2-6
    • 3.4.2-7
    • 3.4.2-8
    • 4.0.3-1
    • 4.0.4-1
    • 4.0.4-2
    Affected ranges
    • ECOSYSTEM: < 4.0.5-1

    Update to 4.0.5-1

  • mopidy Ubuntu:16.04:LTS

    Versions
    • 1.1.0-2
    • 1.1.1-1
    • 1.1.2-1
    • 2.0.0-1
    • 2.0.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:18.04:LTS

    Versions
    • 2.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:20.04:LTS

    Versions
    • 2.2.3-1
    • 2.3.1-1
    • 3.0.1-1
    • 3.0.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:22.04:LTS

    Versions
    • 3.1.1-1
    • 3.2.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:24.04:LTS

    Versions
    • 3.4.1-1
    • 3.4.2-1
    • 3.4.2-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:26.10

    Versions
    • 3.4.2-6
    • 3.4.2-8
    • 3.4.2-8ubuntu1
    • 4.0.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mopidy Ubuntu:26.04:LTS

    Versions
    • 3.4.2-3
    • 3.4.2-4
    • 3.4.2-5
    • 3.4.2-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →