CVE-2026-49340

HIGH

Sentriz Gonic < 0.21.0 - Authenticated Arbitrary Playlist File Write

Title source: manual
STIX 2.1

Description

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with `0o777` permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in `Store.Write`. Version 0.21.0 patches the issue.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0043
EPSS Percentile 35.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-22 CWE-697 CWE-732
Status published
Products (2)
go.senan.xyz/gonic 0 - 0.21.0Go
sentriz/gonic < 0.21.0
Published Jun 19, 2026
Tracked Since Jun 20, 2026