# CVE-2026-49339: sentriz gonic path traversal bypass in playlist handlers

Source: https://junglewise.ai/threats/cve-2026-49339-sentriz-gonic-path-traversal-bypass-in-playlist-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-27  
License: CC BY 4.0 with a link back

CVE-2026-49339 · Severity: high · CVSS 7.1 · Published 2026-06-19

Gonic, a music streaming server, contains a security flaw that allows any logged-in user to access or delete playlists belonging to other users, including administrators. By manipulating the playlist identifier, an attacker can bypass ownership checks intended to keep playlists private. This could lead to the unauthorized disclosure of private playlist data or the accidental loss of curated music collections.

Technologies: [go.senan.xyz/gonic (Go)](https://junglewise.ai/threats/technologies/go-senan-xyz-gonic), [Sentriz Gonic](https://junglewise.ai/threats/technologies/gonic). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sentriz](https://junglewise.ai/threats/vendors/sentriz).

## Quick answers

**Is CVE-2026-49339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49339 being exploited in the wild.

**How severe is CVE-2026-49339?** High severity, with a CVSS score of 7.1, published 19 June 2026.

**Which products and versions are affected?** go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.

**Is there a fix for CVE-2026-49339?** Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49339 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49339?** Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later

  ```sh
  go get go.senan.xyz/gonic@v0.21.0
  ```


## Technical details

A path traversal vulnerability exists in gonic's Subsonic API implementation within the `getPlaylist` and `deletePlaylist` handlers. The application attempts to enforce ownership by extracting a UserID from the first segment of the base64-decoded `id` parameter. However, because the application fails to perform path containment checks or sanitization on the decoded path before calling `filepath.Join`, an attacker can use `..` traversal sequences to point to a different user's directory while keeping their own UserID in the first segment to satisfy the ownership check. This allows authenticated users to read, delete, or probe the existence of arbitrary M3U files on the host. The issue is patched in version 0.21.0.

## Affected products

- sentriz gonic <= 0.20.1

## Identifiers

- CVE-2026-49339
- GHSA-2fp4-5v5c-4448
- GO-2026-5825

## Timeline

- 2026-05-25: disclosed
- 2026-05-25: advisory
- 2026-06-26: patched: Version 0.21.0 released

## References

- [https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448](https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448)
- [https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445](https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445)
- [https://github.com/sentriz/gonic/commit/6dd71e6](https://github.com/sentriz/gonic/commit/6dd71e6)
- [https://api.github.com/repos/sentriz/gonic/security-advisories/GHSA-2fp4-5v5c-4448](https://api.github.com/repos/sentriz/gonic/security-advisories/GHSA-2fp4-5v5c-4448)

## Related threats

- [gonic startScan privilege escalation in music server](https://junglewise.ai/threats/cve-2026-86118-gonic-startscan-privilege-escalation-in-music-server)
- [sentriz gonic path traversal and arbitrary file write in playlist creation](https://junglewise.ai/threats/cve-2026-49340-sentriz-gonic-path-traversal-and-arbitrary-file-write-in-playlist)
- [sentriz gonic improper authorization in Subsonic API playlists](https://junglewise.ai/threats/cve-2026-49338-sentriz-gonic-improper-authorization-in-subsonic-api-playlists)