CVE-2026-49340: Gonic Arbitrary File Write via Playlist Path Traversal

Technical summary

CVE-2026-49340 stems from a logic error in the `ServeCreateOrUpdatePlaylist` endpoint combined with insufficient path validation in the `Store.Write` method. An unreachable guard clause fails to prevent authenticated users from writing M3U playlist content to arbitrary absolute filesystem paths. Additionally, any intermediate directories created during this write operation are initialized with 0o777 permissions (world-readable, writable, and executable), bypassing intended access controls. The vulnerability affects any authenticated Subsonic API user and is independent of the related CVE-2026-49338 and CVE-2026-49339.

Business impact

This vulnerability enables privilege escalation and lateral movement within gonic deployments. An authenticated non-admin user can overwrite or create files throughout the server's filesystem, potentially corrupting application files, injecting malicious content into executable paths, or modifying configuration files. The permissive directory permissions amplify the risk by allowing subsequent unauthorized modifications. Organizations running gonic as a backend service or in multi-tenant environments face particular risk: a compromised low-privilege account becomes a vehicle for system-wide compromise.

Affected systems

Gonic versions prior to 0.21.0 are affected. The vulnerability requires network access to the Subsonic API and valid authentication credentials, limiting exposure to environments where gonic is deployed and user accounts have been created. No vendor-specific product variants were indicated; however, any deployment using an unpatched gonic binary is at risk.

Exploitability

Exploitation requires valid authentication to the gonic instance but no administrative privileges. The attack surface is the `ServeCreateOrUpdatePlaylist` API endpoint, which is typically accessible to any authenticated user. The logic flaw is straightforward: the guard clause that should prevent path traversal is unreachable due to the preceding code structure. An attacker can directly specify an absolute filesystem path in the playlist write request and have it honored. The CVSS 3.1 score of 8.1 reflects low attack complexity, low privileges required, and high impact on both integrity and availability.

Remediation

Upgrade gonic to version 0.21.0 or later. The patch corrects the unreachable guard clause logic and implements proper path containment checks in `Store.Write`, ensuring that playlist writes are confined to the intended directory. Review access controls on the gonic service account and confirm it runs with minimal required privileges. If upgrading is delayed, restrict network access to the Subsonic API endpoint and audit user account creation to reduce the number of potential attackers.

Patch guidance

Apply gonic version 0.21.0 or later. Verify the patch by checking the version reported by the gonic service (typically accessible via `/rest/ping.view` or similar endpoint) and confirming that `ServeCreateOrUpdatePlaylist` now validates playlist write paths. If the service is containerized, rebuild images using the updated gonic binary. If running from source, rebuild from the patched repository commit. No configuration changes are required post-patch, but a service restart is necessary.

Detection guidance

Monitor gonic logs for unusual `ServeCreateOrUpdatePlaylist` requests that include absolute paths in playlist parameters—legitimate playlist operations typically use relative names or IDs. Check for unexpected file creation or modification outside the gonic data directory, especially in system directories (`/etc`, `/usr/bin`, `/var/log`). Look for directory creation events with 0o777 permissions. Network-level detection can identify POST/GET requests to the `/rest/createPlaylist.view` or `/rest/updatePlaylist.view` endpoints with path traversal indicators (`../`, absolute paths). File integrity monitoring on critical system directories will alert to unauthorized writes.

Why prioritize this

Patch this vulnerability with high priority. The combination of low attack complexity, requirement for only basic user authentication, and high impact on system integrity and availability justifies immediate action. The CVSS 8.1 HIGH score and the relative ease of exploitation mean that any delay increases risk, especially in multi-user or internet-facing gonic deployments. The fix is stable and widely available.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity requiring only standard API calls (AC:L), low privilege requirements since any authenticated user suffices (PR:L), no user interaction needed (UI:N), and high impact on both integrity (I:H, via arbitrary file write) and availability (A:H, via file corruption or service disruption). Confidentiality impact is none (C:N) because the vulnerability does not leak information.

Frequently asked questions