Logic Error in gonic Music Streaming Server Allows Arbitrary Playlist Manipulation
CVE-2026-49340

8.1HIGH

Key Information:

Vendor

Sentriz

Status
Gonic
Vendor
CVE Published:
19 June 2026

What is CVE-2026-49340?

A logic error in the gonic music streaming server's ServeCreateOrUpdatePlaylist function allows authenticated users, including non-admins, to write playlist M3U content to an absolute filesystem path controlled by an attacker. This flaw permits the creation of directories with 0o777 permissions, potentially exposing sensitive information. The issue arises from an unreachable guard clause and the lack of path containment in Store.Write. Users are encouraged to upgrade to version 0.21.0 or later to mitigate this vulnerability.

Affected Version(s)

gonic < 0.21.0

References

https://github.com/sentriz/gonic/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.