Advisories » MGASA-2026-0588

Updated mopidy package fixes a security vulnerability

Publication date: 10 Nov 2026
Modification date: 10 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-111925

Description

Mopidy before 4.0.5 contains a path traversal vulnerability that allows
unauthenticated clients to access local files outside file/media_dirs
because FileLibraryProvider.lookup() lacks a containment check.
Attackers can call core.library.lookup or core.tracklist.add over
JSON-RPC or WebSocket with file:// URIs to probe file existence, read
tag metadata, and play out-of-sandbox files.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36615
• https://github.com/mopidy/mopidy/issues/2350
• https://www.cve.org/CVERecord?id=CVE-2026-111925

SRPMS

10/core

• mopidy-3.4.2-4.mga10