CVE-2026-49339: Gonic Path Traversal Bypass in Playlist Ownership Check

Technical summary

Gonic's playlist access control relies on validating `playlist.UserID` against the requesting user's ID to enforce boundary separation. However, the `UserID` value is derived directly from the first path segment of an attacker-controlled playlist ID parameter without path canonicalization or containment checks. An authenticated attacker can supply a playlist ID like `../../other_user/playlist` to traverse the filesystem and resolve to arbitrary playlist resources outside their ownership scope. The vulnerability exploits a logical gap between user validation and path resolution: the ownership check happens on unsanitized input, and file path operations do not enforce directory boundaries. This is distinct from the original GONIC-1 IDOR (which allowed direct cross-user access) but achieves the same effect through path manipulation. Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 adds proper path containment.

Business impact

Gonic deployments are typically used by small teams and individuals for self-hosted music streaming. The vulnerability allows any authenticated user—including those with minimal privileges—to violate user data isolation. An attacker can enumerate other users' music libraries, delete playlists belonging to other users (causing disruption and data loss), and probe the server filesystem for sensitive files. In multi-tenant or shared deployments, this represents a serious breach of confidentiality and integrity. Organizations relying on Gonic for private media management should prioritize patching to prevent unauthorized access to personal music collections and metadata.

Affected systems

Gonic versions prior to 0.21.0 are vulnerable. The affected functionality involves playlist management endpoints that accept a user-supplied playlist ID parameter. Any deployment exposing Gonic to multiple authenticated users (or untrusted authenticated users) is at risk. Subsonic protocol clients and integrations that interact with Gonic's playlist API are in scope. Single-user deployments where all authenticated users are fully trusted may have lower practical risk, but isolation is not guaranteed without the fix.

Exploitability

Exploitability is straightforward. The vulnerability requires authentication (lowering the barrier compared to unauthenticated exploits) but authentication is typically easy to obtain in Gonic deployments that accept user registrations. No special tools, timing, or user interaction are required; an attacker can craft a simple HTTP request with a malicious playlist ID to trigger the vulnerability. The path traversal pattern is well-known and widely tooled, making this a moderate-to-high exploitability issue for any attacker with valid credentials. The CVSS vector (AC:L, PR:L, UI:N) reflects these conditions.

Remediation

Upgrade to Gonic version 0.21.0 or later. Prior to upgrading, restrict Gonic access to trusted users only and review any unexpected changes to shared playlists or filesystem access logs. After patching, confirm that path containment is enforced by testing playlist ID input validation in your environment. If you maintain a fork or internal modification of Gonic, audit playlist ID parsing and ensure that file path resolution follows the principle of least privilege and validates against an allow-list of valid playlist locations.

Patch guidance

Gonic maintainers released version 0.21.0 containing commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445, which implements proper path containment for playlist ID parameters. Verify the commit hash in your target version via the Gonic repository. Update via your package manager or by rebuilding from source. Test playlist operations across multiple user accounts to confirm that cross-user access is no longer possible. If running Gonic in a container, rebuild your image with the patched version. Monitor logs for any suspicious playlist access patterns before and immediately after patching.

Detection guidance

Look for HTTP requests to playlist endpoints (typically in the Subsonic API path) that contain path traversal sequences such as `../`, `..\`, `%2e%2e`, or encoded variants in the playlist ID parameter. Monitor for playlist operations (read, delete, modify) issued by users whose account name does not match the decoded owner in the playlist path. Check filesystem access logs for unexpected traversal outside the intended playlist directory. Establish a baseline of legitimate playlist IDs in your environment and alert on anomalies. If you have access logs, search for patterns where a single user account accesses playlists with IDs suggesting ownership by other users.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.1) and should be prioritized because it combines authenticated access with high impact (confidentiality breach and integrity violation). Unlike many IDOR flaws that only expose data, this issue allows destructive actions (playlist deletion) and filesystem probing. The fix is straightforward and non-breaking, making remediation low-risk. Organizations with multi-user Gonic instances should treat this as urgent; single-user deployments can defer but should still plan to patch within a standard maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: Network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), limited confidentiality impact (C:L), high integrity impact (I:H), and no availability impact (A:N). The high integrity score accounts for the ability to delete other users' playlists. The confidentiality impact is rated low rather than high because the attacker must already be authenticated and can only view playlists (not arbitrary files with confirmed content leakage). The rating appropriately emphasizes the destructive potential over information disclosure.

Frequently asked questions