CVE-2026-49130: Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspfchardata function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Music Player Daemon (MPD) XSPF playlist plugin (xspf_char_data)to a version that resolves this vulnerability.Fixed in 0.24.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49130?
The severity of CVE-2026-49130 is rated as medium with a score of 5.3.
How do I fix CVE-2026-49130?
To fix CVE-2026-49130, upgrade Music Player Daemon to version 0.24.11 or later.
What type of vulnerability is CVE-2026-49130?
CVE-2026-49130 is a CRLF injection vulnerability.
Which component is affected by CVE-2026-49130?
CVE-2026-49130 affects the XSPF playlist plugin in Music Player Daemon.
What can attackers achieve with CVE-2026-49130?
Attackers can embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist.