Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by VulnCheck

CVE-2026-49129Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

Medium 5.8

In plain English

A medium-severity server-side request forgery in MPD from MusicPlayerDaemon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mpdno fix listedDEBIAN-CVE-2026-49129
Debian:13mpdno fix listedDEBIAN-CVE-2026-49129
Debian:14mpd0.24.12-1DEBIAN-CVE-2026-49129
Ubuntu:22.04:LTSmpdno fix listedUBUNTU-CVE-2026-49129
Ubuntu:24.04:LTSmpdno fix listedUBUNTU-CVE-2026-49129
Ubuntu:25.10mpdno fix listedUBUNTU-CVE-2026-49129
Ubuntu:26.04:LTSmpdno fix listedUBUNTU-CVE-2026-49129
Ubuntu:26.10mpdno fix listedUBUNTU-CVE-2026-49129

Affected products (as reported)

VendorProductVersions
MusicPlayerDaemon MPD 0 – before 0.24.11

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References