Flb Music Player
Monthly
Path traversal in FLB-Music Player 1.1.8 through 1.2.1 allows a locally present, low-privileged and authenticated user to read and write files outside the intended music-library directory by supplying crafted track data (path or metadata) that reaches the unsanitised path.join call in /src/main/core/createParsedTrack.ts. Exploitation requires local access and low privileges (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N and our assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so the impact is bounded to Low confidentiality, integrity and availability within the application's own privilege level with no scope change. Publicly available exploit code exists, but this is not in CISA KEV and shows no sign of confirmed active exploitation; the vendor did not respond to the disclosure, so no vendor patch is available.
Path traversal in FLB-Music Player 1.1.8 through 1.2.1 allows a locally present, low-privileged and authenticated user to read and write files outside the intended music-library directory by supplying crafted track data (path or metadata) that reaches the unsanitised path.join call in /src/main/core/createParsedTrack.ts. Exploitation requires local access and low privileges (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N and our assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so the impact is bounded to Low confidentiality, integrity and availability within the application's own privilege level with no scope change. Publicly available exploit code exists, but this is not in CISA KEV and shows no sign of confirmed active exploitation; the vendor did not respond to the disclosure, so no vendor patch is available.