EUVD-2026-38062
GHSA-2fp4-5v5c-4448
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-reachable Subsonic API, any authenticated user (PR:L), no user interaction; integrity high due to arbitrary cross-user playlist deletion and out-of-base writes, confidentiality low (playlist metadata and path-existence oracle), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the *first path segment* of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the 6dd71e6 fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the id parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.
AnalysisAI
Authenticated path traversal in gonic music streaming server allows any Subsonic user to read or delete other users' playlists and probe arbitrary host file paths by smuggling .. segments into the playlist id parameter. The flaw bypasses the ownership check introduced in commit 6dd71e6, which derived playlist.UserID from the first path segment of the attacker-controlled ID without containing the resolved file path. No public exploit identified at time of analysis, but a proof-of-concept test case is embedded in the upstream patch.
Technical ContextAI
gonic (cpe:2.3:a:sentriz:gonic) is a self-hosted Subsonic-compatible music streaming server written in Go. Playlists are stored as files (e.g. m3u) under a base directory, addressed by a relative path encoded into the Subsonic id parameter. The vulnerable playlist.Store.Read/Write/Delete methods called filepath.Join(basePath, relPath) without verifying the resulting path remained under basePath, and the ownership decision (userIDFromPath) was computed from the raw, attacker-supplied first path segment rather than the canonicalized path. This is a textbook CWE-22 path traversal combined with a TOCTOU-style identity spoof: a crafted ID such as <victimID>/../<attackerID>/... passes the first-segment check while resolving to a victim file, and an ID starting with .. escapes the playlist directory entirely.
RemediationAI
Vendor-released patch: upgrade gonic to version 0.21.0 or later, which introduces a fileutil.SafeJoin helper that rejects any relative path escaping the playlist base and recomputes playlist.UserID from the cleaned relative path (commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445; advisory GHSA-2fp4-5v5c-4448). Operators who cannot upgrade immediately should restrict the gonic instance to a single trusted user (gonic is a multi-user Subsonic server, so this effectively disables shared-server use), or front the Subsonic API with a reverse proxy that rejects requests whose decoded id parameter contains .., encoded traversal sequences (%2e%2e, ..%2f), or absolute paths - this will break legitimate playlist IDs that legitimately contain those byte sequences, so test before rolling out. As a further hardening step, run the gonic process under a dedicated unprivileged user with read/write access only to the playlist directory, limiting the blast radius of the file-existence probing primitive.
Arbitrary file write in gonic music streaming server prior to v0.21.0 allows any authenticated Subsonic user - including
Broken authorization in gonic music streaming server prior to version 0.21.0 allows any authenticated user to delete or
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today