PT-2026-51009 · Sentriz · Gonic

Shukla304 + 2 · Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49339

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions gonic versions prior to 0.21.0

Description An authenticated Subsonic user can bypass ownership checks to read or delete playlists belonging to other users and probe arbitrary file paths on the host for existence or readability. This occurs because the playlist.UserID is derived from the first path segment of the playlist ID, but there is no path containment on the resolved file path. The issue involves path traversal within the id parameter, allowing a bypass of the boundary intended to prevent insecure direct object references (IDOR), which is a vulnerability where an application provides direct access to objects based on user-supplied input.

Recommendations Update to version 0.21.0.

Fix

IDOR

Path traversal

Weakness Enumeration

CWE-639

CWE-22

Related Identifiers

CVE-2026-49339

Affected Products

Gonic

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49339 · Security Note
• https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445 · Note
• https://github.com/sentriz/gonic/commit/6dd71e6 · Note
• https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448 · Note