PT-2026-20972 · Unknown · Music Assistant

Zdi-Disclosures · Published 2026-02-20 · Updated 2026-03-03 · CVE-2026-26975

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Music Assistant versions 2.6.3 and below

Description Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The /music/playlists/update API allows users to bypass the .m3u extension enforcement and write files anywhere on the filesystem, which is exacerbated by the container running as root. This can be exploited to achieve Remote Code Execution by writing a malicious .pth file to the Python site-packages directory, which will execute arbitrary commands when Python loads. The vulnerable API endpoint is /music/playlists/update and the vulnerable parameter is the file upload functionality within this endpoint.

Recommendations Update to version 2.7.0 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-73

CWE-22

Related Identifiers

CVE-2026-26975

GHSA-7JCC-P6XR-835J

ZDI-26-133

Affected Products

Music Assistant

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26975.json · Exploit
• https://github.com/music-assistant/server/security/advisories/GHSA-7jcc-p6xr-835j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26975 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26975 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-133 · Security Note
• https://github.com/music-assistant/server/releases/tag/2.7.0 · Note
• https://github.com/music-assistant/server/pull/2684 · Note
• https://twitter.com/TheHackerWire/status/2024654452846973164 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2028945700982284695 · Twitter Post
• https://twitter.com/CveFindCom/status/2024834873479888956 · Twitter Post
• https://twitter.com/cracbot/status/2026613197449625951 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024712119187333425 · Twitter Post
• https://t.me/cveNotify/152552 · Telegram Post
• https://t.me/CVEtracker/45222 · Telegram Post