CVE-2026-49340

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49340
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49340.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49340
Aliases
Published
2026-06-19T19:11:20.305Z
Modified
2026-07-15T01:49:22.020429981Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Details

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in ServeCreateOrUpdatePlaylist allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with 0o777 permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in Store.Write. Version 0.21.0 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-697",
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49340.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sentriz/gonic

Affected ranges

Type
GIT
Repo
https://github.com/sentriz/gonic
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a45ecce5186cdca7f699cf4e623c930fcd88ec3e
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.21.0"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.16.0-rc1
v0.16.1
v0.16.2
v0.16.3
v0.16.4
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.2.1
v0.20.0
v0.20.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49340.json"