# CVE-2026-49340: sentriz gonic path traversal and arbitrary file write in playlist creation

Source: https://junglewise.ai/threats/cve-2026-49340-sentriz-gonic-path-traversal-and-arbitrary-file-write-in-playlist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-27  
License: CC BY 4.0 with a link back

CVE-2026-49340 · Severity: high · CVSS 8.1 · Published 2026-06-19

Gonic, a music streaming server, contains a flaw that allows any registered user to write files to arbitrary locations on the host server. An attacker could use this to overwrite critical system files or the application's own database, leading to permanent data loss or a complete service outage. This bypasses intended security restrictions that should prevent regular users from affecting system-level files.

Technologies: [go.senan.xyz/gonic (Go)](https://junglewise.ai/threats/technologies/go-senan-xyz-gonic), [Sentriz Gonic](https://junglewise.ai/threats/technologies/gonic). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sentriz](https://junglewise.ai/threats/vendors/sentriz).

## Quick answers

**Is CVE-2026-49340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49340 being exploited in the wild.

**How severe is CVE-2026-49340?** High severity, with a CVSS score of 8.1, published 19 June 2026.

**Which products and versions are affected?** go.senan.xyz/gonic (Go) <= 0.20.1, SEMVER:introduced=0,fixed=0.21.0; Sentriz Gonic < 0.21.0, <= 0.20.1.

**Is there a fix for CVE-2026-49340?** Yes. go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49340 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49340?** Check whether you run go.senan.xyz/gonic (Go) or Sentriz Gonic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.senan.xyz/gonic (Go): upgrade to 0.21.0 or later

  ```sh
  go get go.senan.xyz/gonic@v0.21.0
  ```


## Technical details

A logic error in the `ServeCreateOrUpdatePlaylist` function in `server/ctrlsubsonic/handlers_playlist.go` results in an unreachable guard clause, effectively bypassing ownership checks for playlists. When combined with a lack of path sanitization in `Store.Write`, which uses `filepath.Join` without validating that the resulting path remains within the intended directory, an authenticated user can use `..` sequences to write M3U-formatted content to any path writable by the Gonic process. This allows for the truncation and overwriting of critical files like `gonic.db`. Additionally, the application uses `os.MkdirAll` with `0o777` permissions, allowing the creation of world-writable directories. The vulnerability is patched in version 0.21.0.

## Affected products

- sentriz gonic <= 0.20.1

## Identifiers

- CVE-2026-49340
- GHSA-4gxv-p5g5-j7w7
- GO-2026-5827

## Timeline

- 2026-05-25: advisory: GitHub Advisory published
- 2026-06-26: disclosed
- 0.21.0: patched

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [gonic startScan privilege escalation in music server](https://junglewise.ai/threats/cve-2026-86118-gonic-startscan-privilege-escalation-in-music-server)
- [sentriz gonic path traversal bypass in playlist handlers](https://junglewise.ai/threats/cve-2026-49339-sentriz-gonic-path-traversal-bypass-in-playlist-handlers)
- [sentriz gonic improper authorization in Subsonic API playlists](https://junglewise.ai/threats/cve-2026-49338-sentriz-gonic-improper-authorization-in-subsonic-api-playlists)