Mopidy
Monthly
Path traversal in Mopidy before 4.0.5 lets unauthenticated clients use JSON-RPC or WebSocket calls such as core.library.lookup and core.tracklist.add with file:// URIs to reach files outside the configured file/media_dirs, enabling file-existence probing, tag metadata disclosure, and playback of out-of-sandbox files. The impact is limited to those operations rather than arbitrary full-content file reads or code execution, and exploitation requires the file backend extension to be enabled plus the HTTP frontend's JSON-RPC/WebSocket API to be reachable; because Mopidy's HTTP server binds to 127.0.0.1 by default, remote exposure generally requires an operator to have reconfigured it for non-loopback access. No public exploit code has been identified at time of analysis, and the issue is assessed as medium severity.
Path traversal in Mopidy before 4.0.5 lets unauthenticated clients use JSON-RPC or WebSocket calls such as core.library.lookup and core.tracklist.add with file:// URIs to reach files outside the configured file/media_dirs, enabling file-existence probing, tag metadata disclosure, and playback of out-of-sandbox files. The impact is limited to those operations rather than arbitrary full-content file reads or code execution, and exploitation requires the file backend extension to be enabled plus the HTTP frontend's JSON-RPC/WebSocket API to be reachable; because Mopidy's HTTP server binds to 127.0.0.1 by default, remote exposure generally requires an operator to have reconfigured it for non-loopback access. No public exploit code has been identified at time of analysis, and the issue is assessed as medium severity.