EUVD-2026-38062
GHSA-2fp4-5v5c-4448
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-reachable Subsonic API, any authenticated user (PR:L), no user interaction; integrity high due to arbitrary cross-user playlist deletion and out-of-base writes, confidentiality low (playlist metadata and path-existence oracle), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the *first path segment* of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the 6dd71e6 fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the id parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.
AnalysisAI
Authenticated path traversal in gonic music streaming server allows any Subsonic user to read or delete other users' playlists and probe arbitrary host file paths by smuggling .. segments into the playlist id parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account on the target gonic Subsonic API (any user role is sufficient - no admin needed) and network reachability to the Subsonic endpoints `getPlaylist`, `deletePlaylist`, or `createPlaylist`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/C:L/I:H/A:N) matches the actual primitive: network-reachable Subsonic API, low complexity, requires a valid low-privileged account, low confidentiality (playlist metadata of other users) and high integrity impact (arbitrary deletion of other users' playlists and write-outside-base for new playlists). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds any low-privileged Subsonic account on a shared gonic server, then issues a `getPlaylist` or `deletePlaylist` Subsonic call with `id` encoding a path like `<their-user-id>/../<victim-user-id>/private.m3u`; the first-segment ownership check sees their own ID while the joined filesystem path resolves to the victim's playlist, which is then returned or deleted. The same primitive with an `id` of `../injected.m3u` against `createPlaylist` lets them write a playlist file outside the playlists base directory, and probing IDs of the form `<self>/../../etc/hostname` reveals which arbitrary host paths exist and are readable by the gonic process. |
| Remediation | Vendor-released patch: upgrade gonic to version 0.21.0 or later, which introduces a `fileutil.SafeJoin` helper that rejects any relative path escaping the playlist base and recomputes `playlist.UserID` from the cleaned relative path (commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445; advisory GHSA-2fp4-5v5c-4448). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all gonic/Subsonic deployments and document versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file write in gonic music streaming server prior to v0.21.0 allows any authenticated Subsonic user - including
Broken authorization in gonic music streaming server prior to version 0.21.0 allows any authenticated user to delete or
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today