CVE-2026-111925
Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy Mopidy
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.0.5MopidyCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
Text from CVE List
Affected versions 1
- Mopidyaffected: all versions before 4.0.5CVE List
References 5
- github.com/mopidy/mopidy/commit/f23c1f8621c3f4eb07a35d37fccb597449d36415Fixvia CVE List
- github.com/mopidy/mopidy/releases/tag/v4.0.5Fixvia CVE List
- vulncheck.com/advisories/mopidy-before-4.0.5-path-traversal-via-file-backend-library-lookupAdvisoryvia CVE List
- github.com/mopidy/mopidy/issues/2350Exploitvia CVE List
- github.com/mopidy/mopidy/blob/v4.0.4/src/mopidy/_exts/file/library.pyReferencevia CVE List