Executive brief
Music Player Daemon (MPD), a popular background service for playing music, contains a security flaw in how it handles file paths. An unauthenticated attacker can bypass security restrictions to view the names and details of files across the entire server. In some cases, they can also read specific image files located outside the designated music folder, potentially exposing sensitive system information.
Technical details
A path traversal vulnerability exists in MPD's LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 functions within the local storage plugin. The root cause is the lack of path canonicalization when joining the storage root with user-supplied URIs, allowing '..' segments to be processed by the kernel's openat() system call. An unauthenticated remote attacker can exploit this via the 'listfiles' command to enumerate directory contents (names, sizes, and timestamps) and the 'albumart' command to read image files (e.g., cover.png, cover.jpg) from arbitrary locations readable by the MPD process. The vulnerability is fixed in version 0.24.11 by validating relative URIs using uri_safe_local().
Affected products
- MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11
Timeline
- 2026-05-14: disclosed: Issue reported on GitHub
- 2026-05-14: patched: Fix committed to repository
- 2026-05-15: advisory: Version 0.24.11 released
- 2026-05-28: advisory: CVE-2026-49128 published
References
- https://github.com/MusicPlayerDaemon/MPD/commit/0b5315b9e5a42cb0e88bf46a7579bb5641543f60
- https://github.com/MusicPlayerDaemon/MPD/issues/2484
- https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11
- https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS
- https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/
- https://www.vulncheck.com/advisories/music-player-daemon-path-traversal-via-localstorage-uri-handling