CVE-2026-10108

Name of the Vulnerable Software and Affected Versions xiaomusic version 0.5.7

Description An unauthenticated path traversal issue exists in the 'GET /music/{file path:path}' endpoint. This occurs due to an incomplete path prefix check and a missing trailing separator in the comparison logic. Unauthenticated attackers can bypass path restrictions by crafting traversal sequences to request files from sibling directories that share the music path prefix, allowing the retrieval of arbitrary files from the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.