Mopidy EUVD-2026-104317

Exploitation requires (1) the Mopidy file backend extension enabled with file/media_dirs configured, and (2) the Mopidy HTTP frontend's JSON-RPC and/or WebSocket API being reachable by the attacker. No authentication is required (PR:N) and no user interaction is needed. The primary limiting factor is that Mopidy's HTTP server binds to 127.0.0.1 (localhost) by default, so remote unauthenticated exploitation is only possible where an operator has reconfigured it to listen on a non-loopback address or placed it behind a reverse proxy; in default local-only deployments the exposure is confined to local or same-host clients. Impact is further limited to file existence probing, tag metadata disclosure, and playback of files outside file/media_dirs - not arbitrary full-content file read or code execution.

This is a medium-severity path traversal (CWE-22) with a moderate, realistic risk profile rather than an emergency. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly reflects network-reachable, low-complexity, unauthenticated access with only LOW confidentiality impact and no integrity or availability impact - consistent with the description, which limits attacker capability to probing file existence, reading tag metadata, and playing out-of-sandbox files rather than full file content exfiltration or code execution. The score of 6.9 overstates intuitive urgency somewhat because the only real impact is limited information disclosure. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or imminent exploitation (no public exploit identified at time of analysis). The key limiting factor not captured in the CVSS network vector is deployment reality: Mopidy's HTTP/WebSocket frontend binds to localhost by default, so unauthenticated network exploitation presupposes an operator has exposed the JSON-RPC/WebSocket interface to untrusted networks - verify this exposure before prioritizing. Overall: a legitimate bug to patch, but closer to a low-to-moderate real-world priority than its CVSS number suggests, absent internet exposure.

An attacker who can reach a Mopidy instance's exposed JSON-RPC HTTP or WebSocket interface sends a core.library.lookup or core.tracklist.add request containing a file:// URI pointing outside the configured file/media_dirs (e.g. file:///etc/passwd). Because FileLibraryProvider.lookup() lacks a containment check, Mopidy probes the path, returns tag metadata, and can play the out-of-sandbox file, enabling the attacker to confirm file existence and leak limited metadata. No public exploit code was identified at time of analysis, and exploitation requires the frontend to be reachable (it listens on localhost by default).