---
id: "CVE-2026-111925"
kind: "vulnerability"
aliases: ["CVE-2026-111925"]
title: "Mopidy: unauthenticated path traversal reads files outside media directories"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mopidy", "package", "python", "self-hosted"]
not_affected_if: ["no-http-frontend-exposed", "version-4.0.5-or-later"]
published_at: "2026-10-19T14:17:00+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111925", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Mopidy: unauthenticated path traversal reads files outside media directories

Mopidy before 4.0.5 fails to check that file:// lookups stay inside the configured media directories. An unauthenticated client using JSON-RPC or WebSocket can probe file existence, read tag metadata, and play files outside the allowed folders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mopidy version with `mopidy --version`, or `pip show mopidy`.
- Check whether the HTTP/WebSocket frontend is reachable from untrusted networks, in the Mopidy config under `[http]` and `[file]` (media_dirs).

## Fix

- Upgrade Mopidy to `4.0.5` or later.
- Until upgraded, restrict the Mopidy HTTP/WebSocket port to trusted networks.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111925

## From the sources

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_