PT-2026-44924 · Xiaomusic · Xiaomusic

Yu Sun · Published 2026-05-29 · Updated 2026-07-13 · CVE-2026-10108

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions xiaomusic version 0.5.7

Description An unauthenticated path traversal issue exists in the 'GET /music/{file path:path}' endpoint. This occurs due to an incomplete path prefix check and a missing trailing separator in the comparison logic. Unauthenticated attackers can bypass path restrictions by crafting traversal sequences to request files from sibling directories that share the music path prefix, allowing the retrieval of arbitrary files from the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-10108

GHSA-5J8P-5RRJ-8WJG

PYSEC-2026-3429

Affected Products

Xiaomusic

References · 16

• 🔥 https://github.com/hanxi/xiaomusic/issues/890 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10108.json · Exploit
• https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-3429 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5j8p-5rrj-8wjg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-10108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10108 · Security Note
• https://github.com/hanxi/xiaomusic · Note
• https://github.com/hanxi/xiaomusic/pull/891 · Note
• https://pypi.org/project/xiaomusic · Note
• https://t.me/CVEtracker/55269 · Telegram Post
• https://vulncheck.com/advisories/xiaomusic-path-traversal-via-get-music-endpoint · Note
• https://github.com/advisories/GHSA-5j8p-5rrj-8wjg · Note
• https://twitter.com/CVEnew/status/2061216688654209244 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2061967436614648191 · Twitter Post