CVE-2026-49339— sentriz gonic 路径遍历漏洞

Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

对路径名的限制不恰当(路径遍历)

sentriz gonic 路径遍历漏洞

sentriz gonic是sentriz个人开发者的一个音乐流媒体服务器软件。 sentriz gonic 0.21.0之前版本存在安全漏洞，该漏洞源于路径遍历问题，导致经过身份验证的Subsonic用户通过id参数中的路径遍历绕过所有权检查，读取、删除其他用户的播放列表并探查主机上的任意文件路径。

N/A

N/A