{"id":"CVE-2026-111925","kind":"vulnerability","aliases":["CVE-2026-111925"],"related":[],"title":"Mopidy: unauthenticated path traversal reads files outside media directories","description":"Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.","summary":"Mopidy before 4.0.5 fails to check that file:// lookups stay inside the configured media directories. An unauthenticated client using JSON-RPC or WebSocket can probe file existence, read tag metadata, and play files outside the allowed folders.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mopidy","package","python","self-hosted"],"not_affected_if":["no-http-frontend-exposed","version-4.0.5-or-later"],"how_to_check":"- Check the installed Mopidy version with `mopidy --version`, or `pip show mopidy`.\n- Check whether the HTTP/WebSocket frontend is reachable from untrusted networks, in the Mopidy config under `[http]` and `[file]` (media_dirs).","fix":"- Upgrade Mopidy to `4.0.5` or later.\n- Until upgraded, restrict the Mopidy HTTP/WebSocket port to trusted networks.","status":"open","published_at":"2026-10-19T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:54+00:00","updated_at":"2026-10-25T03:40:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:40:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mopidy to `4.0.5` or later.\n- Until upgraded, restrict the Mopidy HTTP/WebSocket port to trusted networks.","reach":"network","title":"Mopidy: unauthenticated path traversal reads files outside media directories","impact":"medium","summary":"Mopidy before 4.0.5 fails to check that file:// lookups stay inside the configured media directories. An unauthenticated client using JSON-RPC or WebSocket can probe file existence, read tag metadata, and play files outside the allowed folders.","category":"package","nicknames":[],"who_cares":["mopidy","self-hosted","python"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads tag metadata and plays files outside media directories.","analyst_note":"","how_to_check":"- Check the installed Mopidy version with `mopidy --version`, or `pip show mopidy`.\n- Check whether the HTTP/WebSocket frontend is reachable from untrusted networks, in the Mopidy config under `[http]` and `[file]` (media_dirs).","needs_analyst":false,"not_affected_if":["version-4.0.5-or-later","no-http-frontend-exposed"],"who_is_affected":"Mopidy installations before 4.0.5 that expose the JSON-RPC or WebSocket interface to clients that should not read the local filesystem. Exposure depends on the local network or internet reach of the HTTP frontend. Installations that only listen on localhost or sit behind authentication are less exposed; the sources do not say whether authentication is supported on that interface.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3361,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111925':12A,15A '-2026':11A,14A '4.0.5':24B,61C 'access':72C 'allow':57B,68C 'attack':83C 'call':85C 'check':27B,82C 'client':38B,70C 'configur':33B 'contain':62C,81C 'core.library.lookup':86C 'core.tracklist.add':88C 'cve':10A,13A 'directori':9A,35B 'exist':48B,100C 'fail':25B 'file':6A,47B,54B,74C,99C,110C 'file/media_dirs':76C 'filelibraryprovider.lookup':78C 'folder':58B 'host':21B 'insid':31B 'json':41B,91C 'json-rpc':40B,90C 'lack':79C 'local':73C 'lookup':29B 'media':8A,34B 'metadata':51B,103C 'mopidi':1A,16B,22B,59C 'out-of-sandbox':106C 'outsid':7A,55B,75C 'packag':17B 'path':3A,64C 'play':53B,105C 'probe':46B,98C 'python':18B 'read':5A,49B,101C 'rpc':42B,92C 'sandbox':109C 'self':20B 'self-host':19B 'stay':30B 'tag':50B,102C 'travers':4A,65C 'unauthent':2A,37B,69C 'uri':96C 'use':39B 'vulner':66C 'websocket':44B,94C","nicknames":[],"mitigations":[],"who_affected":"Mopidy installations before 4.0.5 that expose the JSON-RPC or WebSocket interface to clients that should not read the local filesystem. Exposure depends on the local network or internet reach of the HTTP frontend. Installations that only listen on localhost or sit behind authentication are less exposed; the sources do not say whether authentication is supported on that interface.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111925","severity":null,"published_at":"2026-10-19T14:17:00+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}