PT-2026-20972 · Unknown · Music Assistant

Zdi-Disclosures · Publicado 2026-02-20 · Atualizado 2026-03-03 · CVE-2026-26975

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Music Assistant versions 2.6.3 and below

Description Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The /music/playlists/update API allows users to bypass the .m3u extension enforcement and write files anywhere on the filesystem, which is exacerbated by the container running as root. This can be exploited to achieve Remote Code Execution by writing a malicious .pth file to the Python site-packages directory, which will execute arbitrary commands when Python loads. The vulnerable API endpoint is /music/playlists/update and the vulnerable parameter is the file upload functionality within this endpoint.

Recommendations Update to version 2.7.0 or later.

Exploit

Correção

RCE

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-73

CWE-22

Identificadores relacionados

CVE-2026-26975

GHSA-7JCC-P6XR-835J

ZDI-26-133

Produtos afetados

Music Assistant

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26975.json · Exploit
• https://github.com/music-assistant/server/security/advisories/GHSA-7jcc-p6xr-835j · Aviso do Fabricante
• https://github.com/music-assistant/server/releases/tag/2.7.0 · Nota
• https://github.com/music-assistant/server/pull/2684 · Nota
• https://twitter.com/TheHackerWire/status/2024654452846973164 · Publicação no Twitter
• https://twitter.com/TheZDIBugs/status/2028945700982284695 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2024834873479888956 · Publicação no Twitter
• https://twitter.com/cracbot/status/2026613197449625951 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26975 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26975 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2024712119187333425 · Publicação no Twitter
• https://t.me/cveNotify/152552 · Publicação no Telegram
• https://t.me/CVEtracker/45222 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-26-133 · Nota de Segurança