Is CVE-2026-49340 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49340 being exploited in the wild.

How severe is CVE-2026-49340?

High severity, with a CVSS score of 8.1, published 19 June 2026.

Which products and versions are affected?

go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.

Is there a fix for CVE-2026-49340?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49340 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49340?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49340: sentriz gonic path traversal and arbitrary file write in playlist creation

Q: Is there a fix for CVE-2026-49340?

Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49340 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-49340?

Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49340 · Severity: high · CVSS 8.1 · Published 2026-06-19

Gonic, a music streaming server, contains a flaw that allows any registered user to write files to arbitrary locations on the host server. An attacker could use this to overwrite critical system files or the application's own database, leading to permanent data loss or a complete service outage. This bypasses intended security restrictions that should prevent regular users from affecting system-level files.

Technologies: go.senan.xyz/gonic (Go), Sentriz Gonic. Vendors: Go, Sentriz.

Quick answers

Is CVE-2026-49340 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49340 being exploited in the wild.
How severe is CVE-2026-49340?: High severity, with a CVSS score of 8.1, published 19 June 2026.
Which products and versions are affected?: go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.
Is there a fix for CVE-2026-49340?: Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49340 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49340?: Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later
```
go get go.senan.xyz/gonic@v0.21.0
```

Technical details

A logic error in the `ServeCreateOrUpdatePlaylist` function in `server/ctrlsubsonic/handlers_playlist.go` results in an unreachable guard clause, effectively bypassing ownership checks for playlists. When combined with a lack of path sanitization in `Store.Write`, which uses `filepath.Join` without validating that the resulting path remains within the intended directory, an authenticated user can use `..` sequences to write M3U-formatted content to any path writable by the Gonic process. This allows for the truncation and overwriting of critical files like `gonic.db`. Additionally, the application uses `os.MkdirAll` with `0o777` permissions, allowing the creation of world-writable directories. The vulnerability is patched in version 0.21.0.

Affected products

sentriz gonic <= 0.20.1

Identifiers

CVE-2026-49340
GHSA-4gxv-p5g5-j7w7
GO-2026-5827

Timeline

2026-05-25: advisory: GitHub Advisory published
2026-06-26: disclosed
0.21.0: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.