PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49128 MusicPlayerDaemon CVE debrief

Music Player Daemon (MPD) versions prior to 0.24.11 contain a path traversal vulnerability in the local storage plugin. The flaw exists in `LocalStorage::MapFSOrThrow` and `LocalStorage::MapUTF8`, where user-supplied URIs are concatenated with the storage root without canonicalization, allowing `..` segments to persist into the resolved path. An unauthenticated attacker can exploit this via the `listfiles` command to enumerate directory contents (names, sizes, modification times) and the `albumart` command to read image files outside the configured `music_directory`. The vulnerability was disclosed on 2026-05-28 and affects MPD deployments with network-exposed control interfaces.

Vendor
MusicPlayerDaemon
Product
MPD
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-14
Advisory published
2026-05-28
Advisory updated
2026-07-14

Who should care

Organizations running MPD with network-exposed control interfaces; media server administrators; security teams monitoring information disclosure risks in audio streaming infrastructure

Technical summary

The vulnerability stems from unsafe path construction in `src/storage/plugins/LocalStorage.cxx`. The `MapFSOrThrow` and `MapUTF8` functions join the configured storage root with user-provided URI strings using plain string concatenation without `realpath()` or equivalent canonicalization. Directory traversal sequences (`../`) survive into the path passed to `openat()`, which the kernel resolves relative to the process's file system context. The `listfiles` command exposes directory metadata enumeration; `albumart` enables arbitrary image file reading. The fix (commit 0b5315b9) implements proper path canonicalization before filesystem operations.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to MPD 0.24.11 or later to obtain the canonicalization fix in LocalStorage URI handling
  • Restrict network access to MPD control port (default 6600) to trusted hosts only
  • Consider firewall rules or binding to localhost for MPD instances not requiring remote control
  • Review MPD process file system permissions to limit exposure of sensitive directories
  • Monitor for anomalous listfiles or albumart commands with path traversal patterns in MPD logs
  • If immediate patching is not feasible, disable or restrict the local storage plugin if not required for operation

Evidence notes

Vulnerability confirmed via commit 0b5315b9e5a42cb0e88bf46a7579bb5641543f60 addressing path construction in local storage plugin. Issue #2484 tracks the security report. Fixed in release v0.24.11 per official release notes and NEWS file. Independent security research by mstreet97 documents four reachable bugs including this path traversal. VulnCheck advisory provides coordinated disclosure context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49128 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49128

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49128 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49128

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.