Path Traversal Vulnerability in Mopidy Media Server

CVE-2026-111925

What is CVE-2026-111925?

Mopidy, a popular music server, is affected by a path traversal vulnerability prior to version 4.0.5. This flaw allows unauthorized users to exploit the FileLibraryProvider.lookup() method, enabling them to access local files outside of designated media directories. By utilizing file:// URIs through JSON-RPC or WebSocket calls, attackers can probe for the existence of files, read tag metadata, and potentially play files that are outside the application's intended access. This vulnerability poses a significant risk, allowing for unauthorized information disclosure and manipulation of the media serving environment.

References