Medium, CVSS 5.3PyPIAmendedPublished
Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
CVE-2026-23877 · GHSA-pj88-9xww-gxmh
- Affected
- PyPI swingmusic < 2.1.4
- Fixed in
- 2.1.4· Vendor fix available
- Issue
- Swing Music's listfolders() function in the /folder/dir-browser endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Details The @api.post("/dir-browser") endpoint lacks proper path validation and authorization checks: - No authorization requirement: Any authenticated user can access the endpoint - Improper path handling: The code attempts to prepend "/" to non-existent paths but this doesn't prevent traversal: PoC 1. Create a non-admin user 2. Authenticate as a non-admin user 3. Send the following request: 4. The response will list directories from /proc/self instead of restricting to user-accessible paths: Impact Information Disclosure: - Server filesystem structure and layout - Configuration file locations and names - User account names from directory listings - Software versions and installed packages - Log file locations and system paths Additional Risks: -…
Recommended action: Upgrade to 2.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.