Live › vulnerability › CVE-2026-118577
Go to dashboardMusicFreeDesktop versions 0.0.6 through 0.0.8 contain a flaw in the Request Forwarder component that allows server-side request forgery. A remote attacker can make the application send requests to destinations of their choosing, such as internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 23:35 UTC. All times on this page are UTC.
Users and teams running MusicFreeDesktop 0.0.6, 0.0.7 or 0.0.8 where the Request Forwarder is reachable from a network. Installations that only run locally with no remote access to the forwarder are less exposed. The sources do not say which configurations enable the forwarder by default.
No product ranges from the sources yet.
0.0.6, 0.0.7 and 0.0.8b0d3876247a0a64fa0e430e4b21870e41f503182 from the upstream repository0.0.8 once a release containing the patch is published (unknown which release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-118577")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.