Executive brief
Gonic, a music streaming server, contains a security flaw that allows any logged-in user to access or delete playlists belonging to other users, including administrators. By manipulating the playlist identifier, an attacker can bypass ownership checks intended to keep playlists private. This could lead to the unauthorized disclosure of private playlist data or the accidental loss of curated music collections.
Technical details
A path traversal vulnerability exists in gonic's Subsonic API implementation within the `getPlaylist` and `deletePlaylist` handlers. The application attempts to enforce ownership by extracting a UserID from the first segment of the base64-decoded `id` parameter. However, because the application fails to perform path containment checks or sanitization on the decoded path before calling `filepath.Join`, an attacker can use `..` traversal sequences to point to a different user's directory while keeping their own UserID in the first segment to satisfy the ownership check. This allows authenticated users to read, delete, or probe the existence of arbitrary M3U files on the host. The issue is patched in version 0.21.0.
Affected products
- sentriz gonic <= 0.20.1
Timeline
- 2026-05-25: disclosed
- 2026-05-25: advisory
- 2026-06-26: patched: Version 0.21.0 released