Description (CNA)
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| swingmx / swingmusic | affected < 2.1.4 |
CWE
CWE-25, CWE-284
References
- https://github.com/swingmx/swingmusic/security/advisories/GHSA-pj88-9xww-gxmh
- https://github.com/swingmx/swingmusic/commit/9a915ca62af1502b9550722df82f5d432cb73de3
ADP enrichment
No English description supplied.
No references supplied.