MGASA-2026-0588: Updated mopidy package fixes a security vulnerability

Q: Who can exploit this issue?

Unauthenticated clients that can reach Mopidy's JSON-RPC or WebSocket interfaces can exploit it. They can submit file:// URIs to the affected library or tracklist methods.

Q: What can an attacker do with the flaw?

An attacker can probe whether local files exist outside the configured file/media_dirs, read their tag metadata, and cause Mopidy to play files outside those directories.

Q: Are systems running Mopidy 4.0.5 affected?

The issue affects Mopidy versions before 4.0.5. The provided advisory data does not identify any other affected or fixed versions.

Published Nov 10, 2026

Updated

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

Affected Software

1 affected componentFixes available

mageia/mopidy<3.4.2-4.mga10

3.4.2-4.mga10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mageia/mopidy to a version that resolves this vulnerability.
Fixed in 3.4.2-4.mga10
Upgrade
Upgrade Mopidy to a version that resolves this vulnerability.
Fixed in 4.0.5

Event History

Nov 10, 2026

Advisory Published

via OSV·04:31 PM

Data Sourced

via OSV·04:31 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111925

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated clients that can reach Mopidy's JSON-RPC or WebSocket interfaces can exploit it. They can submit file:// URIs to the affected library or tracklist methods.

What can an attacker do with the flaw?

An attacker can probe whether local files exist outside the configured file/media_dirs, read their tag metadata, and cause Mopidy to play files outside those directories.

Are systems running Mopidy 4.0.5 affected?

The issue affects Mopidy versions before 4.0.5. The provided advisory data does not identify any other affected or fixed versions.

MGASA-2026-0588: Updated mopidy package fixes a security vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with the flaw?

Are systems running Mopidy 4.0.5 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with the flaw?

Are systems running Mopidy 4.0.5 affected?