CVE-2026-111925: Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

Q: Which interfaces can an attacker use to exploit this issue?

An attacker can invoke core.library.lookup or core.tracklist.add through the JSON-RPC or WebSocket interfaces, supplying file:// URIs.

Q: What can an unauthenticated attacker do with a successful request?

They can probe for the existence of local files, retrieve tag metadata, and cause Mopidy to play files outside the configured file/media_dirs locations.

Q: What versions are affected and what is the remediation?

Mopidy versions before 4.0.5 are affected. Upgrade to version 4.0.5 or later, which includes the containment check missing from FileLibraryProvider.lookup().

Published Oct 19, 2026

Updated

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

Affected Software

1 affected component

Mopidy Mopidy<4.0.5

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which interfaces can an attacker use to exploit this issue?

An attacker can invoke core.library.lookup or core.tracklist.add through the JSON-RPC or WebSocket interfaces, supplying file:// URIs.

What can an unauthenticated attacker do with a successful request?

They can probe for the existence of local files, retrieve tag metadata, and cause Mopidy to play files outside the configured file/media_dirs locations.

What versions are affected and what is the remediation?

Mopidy versions before 4.0.5 are affected. Upgrade to version 4.0.5 or later, which includes the containment check missing from FileLibraryProvider.lookup().

CVE-2026-111925: Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

Affected Software

Event History

Frequently Asked Questions

Which interfaces can an attacker use to exploit this issue?

What can an unauthenticated attacker do with a successful request?

What versions are affected and what is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which interfaces can an attacker use to exploit this issue?

What can an unauthenticated attacker do with a successful request?

What versions are affected and what is the remediation?