CVE-2026-111925: Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
Affected Software
Event History
Frequently Asked Questions
Which interfaces can an attacker use to exploit this issue?
An attacker can invoke core.library.lookup or core.tracklist.add through the JSON-RPC or WebSocket interfaces, supplying file:// URIs.
What can an unauthenticated attacker do with a successful request?
They can probe for the existence of local files, retrieve tag metadata, and cause Mopidy to play files outside the configured file/media_dirs locations.
What versions are affected and what is the remediation?
Mopidy versions before 4.0.5 are affected. Upgrade to version 4.0.5 or later, which includes the containment check missing from FileLibraryProvider.lookup().