Is CVE-2026-49128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49128 being exploited in the wild.

How severe is CVE-2026-49128?

High severity, with a CVSS score of 7.5, published 28 May 2026.

Which products and versions are affected?

MusicPlayerDaemon Music Player Daemon before 0.24.11.

Is there a fix for CVE-2026-49128?

A patch was published on 2026-05-14: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49128 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49128?

Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49128: Music Player Daemon path traversal in LocalStorage plugin

CVE-2026-49128 · Severity: high · CVSS 7.5 · Published 2026-05-28

Music Player Daemon (MPD), a popular background service for playing music, contains a security flaw in how it handles file paths. An unauthenticated attacker can bypass security restrictions to view the names and details of files across the entire server. In some cases, they can also read specific image files located outside the designated music folder, potentially exposing sensitive system information.

Technologies: MusicPlayerDaemon Music Player Daemon. Vendors: MusicPlayerDaemon.

Quick answers

Is CVE-2026-49128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49128 being exploited in the wild.
How severe is CVE-2026-49128?: High severity, with a CVSS score of 7.5, published 28 May 2026.
Which products and versions are affected?: MusicPlayerDaemon Music Player Daemon before 0.24.11.
Is there a fix for CVE-2026-49128?: A patch was published on 2026-05-14: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49128 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49128?: Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in MPD's LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 functions within the local storage plugin. The root cause is the lack of path canonicalization when joining the storage root with user-supplied URIs, allowing '..' segments to be processed by the kernel's openat() system call. An unauthenticated remote attacker can exploit this via the 'listfiles' command to enumerate directory contents (names, sizes, and timestamps) and the 'albumart' command to read image files (e.g., cover.png, cover.jpg) from arbitrary locations readable by the MPD process. The vulnerability is fixed in version 0.24.11 by validating relative URIs using uri_safe_local().

Affected products

MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11

Timeline

2026-05-14: disclosed: Issue reported on GitHub
2026-05-14: patched: Fix committed to repository
2026-05-15: advisory: Version 0.24.11 released
2026-05-28: advisory: CVE-2026-49128 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.