CVE-2026-10108 json
xiaomusic 0.5.7 Path Traversal via GET /music endpoint
published 2026-05-29 5 mo ago modified 2026-11-08 26 h ago also EUVD-2026-33366 , GHSA-5j8p-5rrj-8wjg , PYSEC-2026-3429
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from sibling directories whose names share the music_path prefix by crafting traversal sequences, bypassing the path restriction due to the missing trailing separator in the comparison logic to retrieve arbitrary files from the server.
Patch / fix
- pypi xiaomusic 0.5.8
- github.com/hanxi/xiaomusic@88404da commit
- github.com/hanxi/xiaomusic#891 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/hanxi/xiaomusic/issues/890 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | xiaomusic | <0.5.8 |
0.5.8 |
Affected products
- hanxi xiaomusic
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/hanxi/xiaomusic/pull/891
issue-tracking, patch, web
-
github.com
/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722
patch, web
-
github.com
/hanxi/xiaomusic/issues/890
issue-tracking, exploit, web
-
vulncheck.com
/advisories/xiaomusic-path-traversal-via-get-music-endpoint
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-10108
advisory
-
github.com
/hanxi/xiaomusic
package
-
pypi.org
/project/xiaomusic
package
-
github.com
/advisories/GHSA-5j8p-5rrj-8wjg
advisory
Sources
- CVE List CVE-2026-10108
- GitHub Advisory GHSA-5j8p-5rrj-8wjg
- NVD CVE-2026-10108
- OSV PYSEC-2026-3429
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.