CVE-2026-49128: Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

Synopsis

A path traversal vulnerability in Music Player Daemon (MPD) before version 0.24.11 allows an unauthenticated remote attacker to escape the configured music_directory by supplying URI strings containing '..' segments to the LocalStorage plugin. The CVSS vector indicates the service is reachable over the network with no authentication and no user interaction required. Successful exploitation gives the attacker read access to arbitrary directories and image files on disk that the MPD process can reach, exposing file names, sizes, modification timestamps, and image content outside the intended storage root. A patched-image rebuild at version 0.24.11 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MPD service over the network; the AV:N vector token confirms over-the-network exposure is the attack path.

• AuthenticationNot required

  No account or credential is needed; PR:N indicates the exploit works against an unauthenticated MPD connection.

• Victim interactionNot required

  No action from a logged-in user or administrator is required; UI:N means the attacker operates entirely without social engineering.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental setup beyond reaching the service.

Blast Radius

• Reads file names, sizes, and modification timestamps of arbitrary directories accessible to the MPD process, bypassing the music_directory boundary.
• Reads raw image file content from any attacker-chosen directory outside the configured storage root via the albumart command.
• Exposes directory structure and file metadata that can be used to map the host filesystem layout for follow-on attacks.