CVE-2026-101036: FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
Exploitation requires local access and low-level privileges. The provided information does not indicate that it can be exploited remotely or without an existing local account or execution context.
Which versions are identified as affected?
The affected versions listed are 1.1.8, 1.1.9, 1.2.0, and 1.2.1 of FLB-Music-Player.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, which can increase the likelihood of attempted exploitation where a local attacker has the required access.
Is a vendor fix or response available?
No vendor response is reported. The vendor was contacted before disclosure but did not respond; the provided information does not identify a patched version or workaround.