CVE-2026-111925

Name	CVE-2026-111925
Description	Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mopidy (PTS)	bookworm	3.4.1-1	vulnerable
	trixie	3.4.2-3	vulnerable
	forky, sid	4.0.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mopidy	source	(unstable)	4.0.5-1

Notes

[trixie] - mopidy <no-dsa> (Minor issue)
[bookworm] - mopidy <postponed> (Minor issue; can be fixed in next update)
https://github.com/mopidy/mopidy/issues/2350
Fixed by: https://github.com/mopidy/mopidy/commit/ed94da8d54ff39ebd93de595cfd37094298c7462 (v4.0.5)