PT-2026-51013

CVE-2026-49340

Published

2026-06-19

Updated

2026-07-30

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gonic versions prior to 0.21.0

Description A logic error in the ServeCreateOrUpdatePlaylist() function allows for arbitrary file write operations within the music streaming server.

Recommendations Update to version 0.21.0 or later. As a temporary workaround, consider restricting access to the ServeCreateOrUpdatePlaylist() function until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Therawdev

Vendors

Affected products

Weakness enumeration

CWE-732: Incorrect Permission Assignment for Critical Resource

CWE-697: Incorrect Comparison

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')