Executive brief
Gonic, a music streaming server, contains a flaw that allows any registered user to write files to arbitrary locations on the host server. An attacker could use this to overwrite critical system files or the application's own database, leading to permanent data loss or a complete service outage. This bypasses intended security restrictions that should prevent regular users from affecting system-level files.
Technical details
A logic error in the `ServeCreateOrUpdatePlaylist` function in `server/ctrlsubsonic/handlers_playlist.go` results in an unreachable guard clause, effectively bypassing ownership checks for playlists. When combined with a lack of path sanitization in `Store.Write`, which uses `filepath.Join` without validating that the resulting path remains within the intended directory, an authenticated user can use `..` sequences to write M3U-formatted content to any path writable by the Gonic process. This allows for the truncation and overwriting of critical files like `gonic.db`. Additionally, the application uses `os.MkdirAll` with `0o777` permissions, allowing the creation of world-writable directories. The vulnerability is patched in version 0.21.0.
Affected products
- sentriz gonic <= 0.20.1
Timeline
- 2026-05-25: advisory: GitHub Advisory published
- 2026-06-26: disclosed
- 0.21.0: patched