Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist

published 2026-06-19 4 mo ago modified 2026-10-25 14 d ago also GHSA-2fp4-5v5c-4448 , GO-2026-5825 , EUVD-2026-38062

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.

Patch / fix

fixed in 1 distros 1 links 2

go go.senan.xyz/gonic 0.21.0

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

github.com/sentriz/gonic@0824bed commit
github.com/sentriz/gonic@6dd71e6 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-22)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
GitHub	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	go.senan.xyz/gonic	<0.21.0	0.21.0

Affected products

sentriz gonic

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-639 Authorization Bypass Through User-Controlled Key

References

github.com /sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445
web
github.com /sentriz/gonic/commit/6dd71e6
web
github.com /sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448
exploit, web, advisory
nvd.nist.gov /vuln/detail/CVE-2026-49339
advisory
github.com /sentriz/gonic
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary