CVE-2026-118577: maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

Published Oct 28, 2026

Updated

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

Affected Software

1 affected component

maotoumao MusicFreeDesktop=0.0.6, =0.0.7, =0.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maotoumao MusicFreeDesktop to a version that resolves this vulnerability.
Patch b0d3876247a0a64fa0e430e4b21870e41f503182

Event History

Oct 28, 2026

CVE Published

via MITRE·10:15 PM

Data Sourced

via MITRE·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which releases are known to be affected?

maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8 are identified as impacted.

Can this be exploited remotely, and does an attacker need an account?

Remote exploitation is possible. The provided severity vector indicates no privileges are required, although user interaction is required.

Is public exploit code available?

Yes. The exploit is publicly available and might be used.

What remediation is available?

Apply the vendor patch identified as b0d3876247a0a64fa0e430e4b21870e41f503182.