Executive brief
xiaomusic, a music player application, contains a security flaw that allows unauthorized users to access files on the host server. By sending specially crafted web requests, an attacker can bypass folder restrictions to read sensitive data from directories they should not have access to. This could lead to the exposure of private configuration files or other user data stored on the same system.
Technical details
A path traversal vulnerability exists in xiaomusic versions prior to 0.5.8 within the 'music_file()' and 'get_picture()' functions. The vulnerability is caused by an incomplete validation logic that uses a 'startswith' check on directory paths without a trailing directory separator. An unauthenticated remote attacker can exploit this by using traversal sequences (e.g., '../') to access sibling directories that share the same name prefix as the intended music or picture directories. This allows for arbitrary file read access on the server. The issue is resolved in version 0.5.8 by ensuring a trailing separator is included in path containment checks.
Affected products
- hanxi xiaomusic < 0.5.8
Timeline
- 2026-05-26: patched: Fix merged into main branch via pull request 891
- 2026-05-29: disclosed: CVE-2026-10108 published
- 2026-07-02: advisory: GitHub Advisory reviewed and updated