VulnSocial

CVE-2026-49339Patch

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-06-20)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-19: 1Mentions · 2026-06-20: 2Patch / Workaround · 2026-06-20: 2Technical Details · 2026-06-19: 106-1906-20
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-191
Disclosure1
2026-06-202
Patch2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Patch

    🚨*CVE* CVE-2026-49339 gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added… https://www.cve.org/CVERecord?id=CVE-2026-49339 ----- Traducción: CVE-2026-49339 gon… http://infoflow.cloud`

    Post summary

    CVE-2026-49339 was reported for the gonic music streaming server, and a commit containing a fix indicates a patch is available, but no exploitation details or specific vulnerability type are disclosed.

    0000043
    88 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-49339 gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added… https://www.cve.org/CVERecord?id=CVE-2026-49339

    Post summary

    CVE-2026-49339 impacts the gonic music streaming server; a patch was added by the maintainer, referenced by commit hash, and linked to the CVE record.

    00000234
    57.7K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-49339 Path Traversal and Ownership Check Bypass in Gonic Music Streaming Server https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49339

    Post summary

    This brief post announces CVE-2026-49339, outlining a path traversal and ownership check bypass flaw in the Gonic Music Streaming Server.

    0000032
    4.1K followersView on X

Explore more

Back to dashboard