Xiaomusic
Monthly
Path traversal in xiaomusic v0.5.7 allows unauthenticated attackers to read arbitrary files outside the intended music directory via the GET /music/{file_path:path} endpoint. The flaw stems from an incomplete path prefix check that lacks a trailing separator, enabling bypass through sibling directories. Public proof-of-concept code exists; EPSS estimates a low 0.18% probability of exploitation, and no active exploitation has been confirmed by CISA KEV.
Path traversal in xiaomusic v0.5.7 allows unauthenticated attackers to read arbitrary files outside the intended music directory via the GET /music/{file_path:path} endpoint. The flaw stems from an incomplete path prefix check that lacks a trailing separator, enabling bypass through sibling directories. Public proof-of-concept code exists; EPSS estimates a low 0.18% probability of exploitation, and no active exploitation has been confirmed by CISA KEV.