p PatchFirst

PatchFirst · Latest vulnerabilities

mopidy vulnerabilities

Vulnerabilities published for mopidy in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2026-111925

    Medium · CVSS 6.9EPSS 0.43%Fix available

    Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

    Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

    mopidyOperating systems
    • Update to 4.0.5-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →