CVE-2026-111925

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111925
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111925.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111925
Downstream
Published
2026-10-19T13:55:08Z
Modified
2026-10-28T02:31:00Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Details

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111925.json"
}
References

Affected packages

Git / github.com/mopidy/mopidy

Affected ranges

Type
GIT
Repo
https://github.com/mopidy/mopidy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
995fda683fb933e0d10895faab3872f707b87f0c
Fixed
f23c1f8621c3f4eb07a35d37fccb597449d36415
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.0.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "f23c1f8621c3f4eb07a35d37fccb597449d36415"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v4.0.5",
            "range": [
                {
                    "fixed": "995fda683fb933e0d10895faab3872f707b87f0c"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.0a1
v0.1.0a2
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.16.0
v0.16.1
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.19.0
v0.19.1
v0.19.2
v0.19.3
v0.19.4
v0.19.5
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.8.0
v0.8.1
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.1.0
v1.1.1
v1.1.2
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.3.1
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.4.0
v3.4.1
v3.4.2
v4.*
v4.0.0
v4.0.0a10
v4.0.0a11
v4.0.0a12
v4.0.0a13
v4.0.0a14
v4.0.0a15
v4.0.0a2
v4.0.0a3
v4.0.0a4
v4.0.0a5
v4.0.0a6
v4.0.0a7
v4.0.0a8
v4.0.0a9
v4.0.0rc1
v4.0.0rc2
v4.0.1
v4.0.2
v4.0.3
v4.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111925.json"