CVE-2026-49128: MPD Path Traversal Information Disclosure Vulnerability

Technical summary

The vulnerability resides in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 functions within MPD's local storage plugin. When resolving user-supplied URIs to filesystem paths, the code concatenates the storage root directory with the user input without canonicalizing the result. This allows path traversal sequences (such as '..') to persist through the string concatenation and only get resolved at the kernel level during openat() system calls. An attacker leveraging the listfiles command can enumerate directory metadata (names, sizes, modification times) across any path accessible to the MPD process. The albumart command further enables reading of image files from arbitrary directories, effectively bypassing the music_directory boundary.

Business impact

For organizations running MPD as a shared music service or embedded in media applications, this vulnerability enables credential-free information disclosure. Attackers can discover system structure, identify other users' personal media, or locate configuration files—creating risk of privilege escalation paths or targeted social engineering. The lack of authentication requirement means any network-connected client can probe the system. While not offering write access or direct code execution, the reconnaissance capability poses meaningful harm to confidentiality and operational security posture.

Affected systems

Music Player Daemon (MPD) in all versions before 0.24.11 are vulnerable. This includes deployments across desktop Linux systems, NAS devices, embedded media servers, and containerized environments where MPD is used for local audio playback or streaming. Any instance with network accessibility and unauthenticated access enabled is at risk. Verify your installed MPD version against vendor release notes.

Exploitability

Exploitation is straightforward: an attacker needs only network access to the MPD daemon port (typically 6600) and knowledge of basic MPD commands. No authentication is required, no user interaction is needed, and no special network conditions must be met. The attack surface is low-complexity, making this readily exploitable by script-based reconnaissance tools or manual enumeration.

Remediation

Upgrade Music Player Daemon to version 0.24.11 or later. The patch addresses the vulnerability by implementing proper path canonicalization before file operations, ensuring that '..' segments and other traversal sequences are resolved safely and cannot escape the configured storage directory. Review vendor advisory documentation for detailed upgrade procedures specific to your deployment method (native packages, containers, etc.).

Patch guidance

Apply the MPD 0.24.11 update through your distribution's package manager or via direct compilation from upstream sources. Test the upgrade in a non-production environment first to ensure compatibility with your MPD configuration and connected clients. After patching, restart the MPD service and verify that music playback and legitimate file browsing operations function as expected. For containerized deployments, update base images and rebuild containers with the patched MPD version.

Detection guidance

Monitor for suspicious MPD command sequences, particularly repeated listfiles or albumart commands targeting paths outside the configured music_directory. Examine MPD logs for file access patterns that span multiple directory levels or reference parent directories (..). If MPD is exposed to untrusted networks, implement network-level access controls to restrict connections to authorized clients only. Use filesystem integrity monitoring to detect unexpected file reads by the MPD process.

Why prioritize this

This vulnerability merits prompt remediation because it requires no authentication, no user interaction, and no special network conditions—lowering the barrier to exploitation to near-zero. While limited to information disclosure rather than remote code execution, the ability to enumerate and read arbitrary files accessible to the MPD process directly compromises confidentiality. Organizations running MPD in multi-user or network-exposed scenarios should prioritize patching within their standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated vulnerability with high confidentiality impact and no complexity barriers. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates the flaw can be exploited remotely with low effort, affects only the confidentiality of the target system, and requires no privileges or user interaction. The score appropriately captures the severity of uncontrolled information disclosure, though actual risk depends on deployment context and network exposure.

Frequently asked questions