Live › vulnerability › CVE-2026-111925
Go to dashboardMopidy before 4.0.5 fails to check that file:// lookups stay inside the configured media directories. An unauthenticated client using JSON-RPC or WebSocket can probe file existence, read tag metadata, and play files outside the allowed folders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Mopidy installations before 4.0.5 that expose the JSON-RPC or WebSocket interface to clients that should not read the local filesystem. Exposure depends on the local network or internet reach of the HTTP frontend. Installations that only listen on localhost or sit behind authentication are less exposed; the sources do not say whether authentication is supported on that interface.
No product ranges from the sources yet.
mopidy --version, or pip show mopidy.[http] and [file] (media_dirs).4.0.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
This page as .md · .json · in your agent: get_signal("CVE-2026-111925")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.