CVE-2026-10108: Unauthenticated Path Traversal in xiaomusic v0.5.7 – File Read Vulnerability

Technical summary

The vulnerability is a path traversal flaw (CWE-22) in the GET /music/{file_path:path} endpoint of xiaomusic v0.5.7. The application attempts to restrict file access to a designated music directory but implements an incomplete prefix check: it compares the requested path against a music_path prefix without enforcing a trailing path separator. This allows an attacker to request files from sibling directories whose names start with the music_path string. For example, if the music directory is /app/music, an attacker could access /app/music_backup or /app/music-private by exploiting the missing separator in the comparison logic. The lack of authentication on this endpoint means no credentials are required to exploit it.

Business impact

An attacker exploiting this flaw can exfiltrate sensitive data stored on the xiaomusic server, including application configuration (which may contain API keys or database credentials), user data, private encryption keys, or source code. In environments where xiaomusic runs alongside other services or stores sensitive information, the blast radius extends beyond music files. This is particularly concerning if xiaomusic instances are exposed to the internet or accessible from untrusted networks. Data loss and credential compromise are direct risks.

Affected systems

xiaomusic v0.5.7 is affected. Organizations running this specific version with the vulnerable endpoint exposed should prioritize assessment. Check deployment logs and asset inventories to identify all instances. If your organization uses xiaomusic, verify the installed version immediately. Vendors_products data indicates no specific downstream products are listed in the CVE record, so the impact is limited to direct xiaomusic deployments.

Exploitability

This vulnerability is straightforward to exploit. It requires no authentication, no special user interaction, and no complex setup—just a standard HTTP GET request with a crafted path parameter. The attack is reliable across network conditions (network-accessible, low complexity). An attacker with network access to the xiaomusic instance can begin exfiltrating files within seconds. Public proof-of-concept information may accelerate weaponization, though the CVSS vector reflects the inherent ease of exploitation (AV:N/AC:L/PR:N/UI:N).

Remediation

Upgrade xiaomusic to a patched version that correctly implements path validation. The fix must enforce a trailing path separator in the prefix comparison to ensure only files under the intended music directory are accessible. Verify against the vendor's advisory for the minimum patched version. As an interim mitigation, restrict network access to xiaomusic instances using firewall rules, reverse proxy authentication, or IP whitelisting. Do not rely on network isolation as a permanent solution.

Patch guidance

Consult the xiaomusic project repository or vendor advisories for the available patched release. Apply the update to all affected v0.5.7 instances in your environment. Test the patch in a non-production environment first to ensure compatibility with your deployment. After patching, verify that the /music endpoint correctly rejects traversal attempts by testing access to files outside the music directory.

Detection guidance

Monitor HTTP access logs for suspicious GET requests to the /music endpoint containing path traversal sequences (../, ..\, encoded variants like %2e%2e%2f). Look for requests targeting sensitive file paths (e.g., /etc/passwd, /app/config, files with extensions like .key, .pem, .conf). Correlate failed authentication attempts or 403 responses with subsequent 200 responses to the same endpoint, which may indicate an attacker probing then successfully exploiting the flaw. Endpoint detection and response (EDR) tools should flag unexpected file read patterns from the xiaomusic process.

Why prioritize this

This is a HIGH severity vulnerability (CVSS 7.5) that requires prompt action. It combines a high attack surface (unauthenticated, network-accessible), trivial exploitation, and meaningful confidentiality impact. The lack of KEV status does not diminish urgency—the vulnerability is objectively easy to exploit and affects data confidentiality. Organizations with exposed xiaomusic instances should treat this as a critical priority for immediate patching or isolation.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), unchanged scope (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. The score appropriately penalizes the unauthenticated access and ease of exploitation, balanced against the fact that the attacker can only read files, not modify or disrupt the service.

Frequently asked questions