Vulnerability · Published Jun 19, 2026 · Assigned by GitHub_M
CVE-2026-49339Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist
High 7.1
In plain English
A high-severity path traversal in gonic from sentriz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.senan.xyz/gonic | 0.21.0 | GHSA-2fp4-5v5c-4448 |
| Go | go.senan.xyz/gonic | 0.21.0 | GO-2026-5825 |
Affected products (as reported)
Weakness: CWE-22, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448 x_refsource_CONFIRM
- https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445 x_refsource_MISC
- https://github.com/sentriz/gonic/commit/6dd71e6 x_refsource_MISC