FLB-Music Player CVE-2026-101036

Requires LOCAL access with low privileges (AV:L/PR:L) to the machine running FLB-Music-Player, and the ability to supply attacker-controlled track data (file path/metadata) that reaches the path.join call in /src/main/core/createParsedTrack.ts. No user interaction beyond normal track parsing (UI:N). Exploitation is LIMITED by the need for local presence and the absence of any remote/network vector, plus impact is bounded to Low read/write within the app's privilege level; there is no privilege escalation or scope change (SC/SI/SA:N).

This is a low-real-risk issue despite being a legitimate path traversal (CWE-22). The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, score 1.9) confirms the two factors that cap real-world risk: the attack is LOCAL (AV:L) and requires some privilege (PR:L), with only Low impact to confidentiality, integrity, and availability. FLB-Music-Player is a desktop (Electron/TypeScript) media player, so the flaw is triggered by locally supplied/parsed track data rather than a remote network request. Signals are consistent and point low: no EPSS score is provided, there is NO CISA KEV listing, and while a POC exists ('publicly available exploit code exists'), POC availability is distinct from active exploitation - nothing here indicates in-the-wild use. The only mild upgrade consideration is that on CVSS 3.1 the same local/low-priv/low-triad profile scores higher (~5.3) than the 4.0 1.9, because 3.1 weights any-impact more heavily; this is a scoring-model difference, not a disagreement about facts. Net: a real but minor local vulnerability in an obscure product - low priority.

A user opens or imports a maliciously crafted music track/library entry whose stored path contains traversal sequences; the app's createParsedTrack.ts uses path.join without sanitization, resolving outside the intended media directory to read or write files with the app's privileges. A public POC exists on the researcher's blog demonstrating the traversal. Because the attack is local and needs prior low-level access/interaction with attacker-supplied data, it cannot be launched remotely.