Vulnerability · Published May 28, 2026 · Assigned by VulnCheck

CVE-2026-49128Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

High 7.5

In plain English

A high-severity path traversal in MPD from MusicPlayerDaemon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to enumerate names, sizes, and modification times of arbitrary directories readable by the MPD process, and the albumart command to read image files in any attacker-chosen directory outside the configured music_directory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	mpd	no fix listed	DEBIAN-CVE-2026-49128
Debian:13	mpd	no fix listed	DEBIAN-CVE-2026-49128
Debian:14	mpd	0.24.12-1	DEBIAN-CVE-2026-49128
Ubuntu:22.04:LTS	mpd	no fix listed	UBUNTU-CVE-2026-49128
Ubuntu:24.04:LTS	mpd	no fix listed	UBUNTU-CVE-2026-49128
Ubuntu:25.10	mpd	no fix listed	UBUNTU-CVE-2026-49128
Ubuntu:26.04:LTS	mpd	no fix listed	UBUNTU-CVE-2026-49128
Ubuntu:26.10	mpd	no fix listed	UBUNTU-CVE-2026-49128

Affected products (as reported)

Vendor	Product	Versions
MusicPlayerDaemon	MPD	0 – before 0.24.11

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html technical-description, exploit
https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ release-notes, patch
https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS release-notes
https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 release-notes
https://github.com/MusicPlayerDaemon/MPD/issues/2484 issue-tracking
https://github.com/MusicPlayerDaemon/MPD/commit/0b5315b9e5a42cb0e88bf46a7579bb5641543f60 patch
https://www.vulncheck.com/advisories/music-player-daemon-path-traversal-via-localstorage-uri-handling third-party-advisory