CVE-2026-23877

Swing Music: From Playlist to Password File via CVE-2026-23877

Alon Barad
Alon Barad
Software Engineer

Jan 21, 2026·6 min read·4 visits

Executive Summary (TL;DR)

Swing Music versions prior to 2.1.4 fail to sanitize file paths in the `list_folders` API. This allows any logged-in user—even those without admin rights—to traverse out of the music directory using `../../` sequences and list the contents of arbitrary system folders. The fix implements strict path resolution and boundary checks.

A classic directory traversal vulnerability in the Swing Music player allows any authenticated user to escape the music library sandbox and browse the host server's entire filesystem.

Fix Analysis (1)

Technical Appendix

CVSS Score
5.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Probability
0.20%
Top 58% most exploited

Affected Systems

Swing Music < 2.1.4

Affected Versions Detail

Product
Affected Versions
Fixed Version
Swing Music
swingmx
< 2.1.42.1.4
AttributeDetail
CWE IDCWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
CVSS v4.05.3 (Medium)
Attack VectorNetwork (Authenticated)
ImpactInformation Disclosure / Filesystem Enumeration
Patch Commit9a915ca62af1502b9550722df82f5d432cb73de3
EPSS Score0.00200 (Low Probability)
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Vulnerability Timeline

Vulnerability reported by researcher @d-virtuosa
2026-01-18
Fix committed by vendor
2026-01-18
GHSA published
2026-01-19
CVE assigned
2026-01-19

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.