EUVD-2026-38068
GHSA-4gxv-p5g5-j7w7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable Subsonic API (AV:N), trivial request (AC:L), requires any authenticated user but not admin (PR:L), no UI; arbitrary file write yields I:H and A:H, no direct read so C:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in ServeCreateOrUpdatePlaylist allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with 0o777 permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in Store.Write. Version 0.21.0 patches the issue.
AnalysisAI
Arbitrary file write in gonic music streaming server prior to v0.21.0 allows any authenticated Subsonic user - including non-admin accounts - to write attacker-controlled M3U playlist content to any absolute filesystem path on the host, while also creating intermediate directories with world-writable 0o777 permissions. The flaw stems from an unreachable guard clause in ServeCreateOrUpdatePlaylist combined with missing path containment in Store.Write. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-4gxv-p5g5-j7w7 documents the issue and a fix is available.
Technical ContextAI
gonic is a Go-based, self-hosted music streaming server implementing the Subsonic API, identified by CPE cpe:2.3:a:sentriz:gonic. The root cause is CWE-22 (Path Traversal / Improper Limitation of a Pathname to a Restricted Directory). Specifically, the ServeCreateOrUpdatePlaylist handler contains a guard clause that is never reached due to a logic error, and the downstream Store.Write helper performs no canonicalization or containment check against a configured playlists directory. Because the attacker controls an absolute path, traditional '../' filtering would not help - the function happily writes to wherever the OS allows the gonic process to write. The MkdirAll-style intermediate directory creation with mode 0o777 further widens impact by leaving traversable, world-writable directories on disk.
RemediationAI
Vendor-released patch: upgrade gonic to version 0.21.0 or later, which adds the missing path containment in Store.Write and corrects the unreachable guard in ServeCreateOrUpdatePlaylist; details are in https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7. If immediate upgrade is not possible, compensating controls include disabling open registration and tightly restricting Subsonic accounts to trusted users (reduces the population that can reach the vulnerable handler but does not eliminate insider risk), running the gonic process as an unprivileged dedicated user under a restrictive umask and with filesystem confinement such as systemd ProtectSystem=strict / ReadWritePaths limited to the music and playlists directories (limits where arbitrary writes can land, at the cost of breaking writes to non-whitelisted paths), and placing gonic behind a reverse proxy that blocks unexpected playlist API verbs (may break legitimate Subsonic clients that use those endpoints). Audit any directories created by gonic for unexpected 0o777 permissions and revert them.
Authenticated path traversal in gonic music streaming server allows any Subsonic user to read or delete other users' pla
Broken authorization in gonic music streaming server prior to version 0.21.0 allows any authenticated user to delete or
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today