Is CVE-2026-49339 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49339 being exploited in the wild.

How severe is CVE-2026-49339?

High severity, with a CVSS score of 7.1, published 19 June 2026.

Which products and versions are affected?

go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.

Is there a fix for CVE-2026-49339?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49339 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49339?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49339: sentriz gonic path traversal bypass in playlist handlers

Q: Is there a fix for CVE-2026-49339?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49339 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49339?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49339 · Severity: high · CVSS 7.1 · Published 2026-06-19

Gonic, a music streaming server, contains a security flaw that allows any logged-in user to access or delete playlists belonging to other users, including administrators. By manipulating the playlist identifier, an attacker can bypass ownership checks intended to keep playlists private. This could lead to the unauthorized disclosure of private playlist data or the accidental loss of curated music collections.

Technologies: go.senan.xyz/gonic (Go), Sentriz Gonic. Vendors: Go, Sentriz.

Quick answers

Is CVE-2026-49339 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49339 being exploited in the wild.
How severe is CVE-2026-49339?: High severity, with a CVSS score of 7.1, published 19 June 2026.
Which products and versions are affected?: go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.
Is there a fix for CVE-2026-49339?: Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49339 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49339?: Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later
```
go get go.senan.xyz/gonic@v0.21.0
```

Technical details

A path traversal vulnerability exists in gonic's Subsonic API implementation within the `getPlaylist` and `deletePlaylist` handlers. The application attempts to enforce ownership by extracting a UserID from the first segment of the base64-decoded `id` parameter. However, because the application fails to perform path containment checks or sanitization on the decoded path before calling `filepath.Join`, an attacker can use `..` traversal sequences to point to a different user's directory while keeping their own UserID in the first segment to satisfy the ownership check. This allows authenticated users to read, delete, or probe the existence of arbitrary M3U files on the host. The issue is patched in version 0.21.0.

Affected products

sentriz gonic <= 0.20.1

Identifiers

CVE-2026-49339
GHSA-2fp4-5v5c-4448
GO-2026-5825

Timeline

2026-05-25: disclosed
2026-05-25: advisory
2026-06-26: patched: Version 0.21.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.