Vulnerability · Published May 29, 2026 · Assigned by VulnCheck

CVE-2026-10108xiaomusic 0.5.7 Path Traversal via GET /music endpoint

High 7.5

In plain English

A high-severity path traversal in xiaomusic from hanxi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from sibling directories whose names share the music_path prefix by crafting traversal sequences, bypassing the path restriction due to the missing trailing separator in the comparison logic to retrieve arbitrary files from the server.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	xiaomusic	0.5.8	GHSA-5j8p-5rrj-8wjg
PyPI	xiaomusic	0.5.8	PYSEC-2026-3429

Affected products (as reported)

Vendor	Product	Versions
hanxi	xiaomusic	0 – through 0.5.70 – through 88404da7a283f2c0a796a4cd16bbb6e6aa1f4722

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue issue-tracking
Pull Request issue-tracking
Patch Commit patch
Release Notes third-party-advisory