CVE-2026-10108 Overview
CVE-2026-10108 is an unauthenticated path traversal vulnerability in xiaomusic v0.5.7. The flaw resides in the GET /music/{file_path:path} endpoint, which enforces an incomplete prefix check against the configured music_path. Because the comparison omits a trailing path separator, attackers can request files from sibling directories whose names begin with the same prefix as music_path. Remote unauthenticated attackers can craft traversal sequences to read arbitrary files from the host file system. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Unauthenticated remote attackers can read arbitrary files from the server, exposing application source code, configuration data, and sensitive system files.
Affected Products
- xiaomusic v0.5.7 (hanxi/xiaomusic GitHub project)
- Earlier versions sharing the same GET /music/{file_path:path} prefix-check logic
- Deployments exposing the xiaomusic HTTP service to untrusted networks
Discovery Timeline
- 2026-05-29 - CVE-2026-10108 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10108
Vulnerability Analysis
The vulnerability exists in the file-serving handler at GET /music/{file_path:path}. The handler resolves the requested path and compares it against the configured music_path directory using a string prefix check. The check does not append a trailing separator before comparison, which means any directory whose name begins with the same prefix as music_path satisfies the validation logic.
An attacker can supply a relative or absolute path that resolves to a sibling directory. For example, if music_path is set to /data/music, a request resolving to /data/music_backup/secret.conf or /data/musicpasswd will pass the prefix comparison. The endpoint then opens and returns the file contents without authentication.
The exposure is significant because xiaomusic deployments often run with broad filesystem read access. Attackers can retrieve configuration files containing API tokens, application source code, and operating system files readable by the service user.
Root Cause
The root cause is an incomplete pathname canonicalization check. The handler validates that the resolved file path starts with the music_path string, but does not enforce that the next character is a directory separator. This logic error is a textbook CWE-22 instance where boundary verification fails to consider sibling directory names.
Attack Vector
Exploitation requires only network access to the xiaomusic HTTP service. No authentication, user interaction, or special privileges are needed. The attacker issues an HTTP GET request to /music/ followed by a crafted path containing traversal sequences such as ../ or by leveraging a sibling directory whose name extends the music_path prefix.
The vulnerability mechanism is documented in the VulnCheck Advisory and the upstream GitHub Issue Report. No verified proof-of-concept code is reproduced here.
Detection Methods for CVE-2026-10108
Indicators of Compromise
- HTTP GET requests to /music/ containing ../, ..%2F, or URL-encoded traversal sequences in access logs
- Requests to /music/ paths that resolve to filenames matching the music_path prefix but reside in sibling directories
- Outbound responses from xiaomusic returning non-audio MIME types or files inconsistent with the configured library
- Repeated 200 OK responses for unusual paths under /music/ from a single source IP
Detection Strategies
- Inspect xiaomusic HTTP access logs for requests under /music/ containing traversal patterns or paths outside the expected media directory
- Deploy web application firewall rules that block encoded and unencoded traversal sequences targeting the /music/{file_path:path} route
- Compare requested file extensions against an allowlist of audio formats supported by xiaomusic
- Alert on responses serving files whose paths do not begin with the canonicalized music_path plus a directory separator
Monitoring Recommendations
- Enable verbose request logging on the xiaomusic service and forward logs to a centralized analytics platform
- Monitor for anomalous read access on configuration files, SSH keys, and credential stores by the xiaomusic service account
- Track baseline traffic volume to /music/ and flag spikes from individual source addresses
- Correlate xiaomusic request patterns with host-level file access telemetry to identify successful exfiltration
How to Mitigate CVE-2026-10108
Immediate Actions Required
- Upgrade xiaomusic to a version that includes the fix from the upstream GitHub Commit Reference
- Restrict network exposure of the xiaomusic service to trusted local networks or behind authenticated reverse proxies
- Run xiaomusic under a dedicated low-privilege user account with read access limited to the media directory
- Audit historical access logs for evidence of exploitation prior to patching
Patch Information
The maintainers addressed the issue in the commit 88404da7a283f2c0a796a4cd16bbb6e6aa1f4722, merged via pull request #891. The fix appends a trailing directory separator to the music_path value before performing the prefix comparison, ensuring that sibling directories no longer satisfy the check. Refer to the GitHub Pull Request for the complete patch diff and the VulnCheck Advisory for vendor-coordinated guidance.
Workarounds
- Place xiaomusic behind a reverse proxy that strips or rejects requests containing .. and encoded traversal sequences
- Run the service inside a container or chroot whose filesystem view contains only the intended music library
- Apply mandatory access controls such as AppArmor or SELinux profiles to restrict the process to the media directory
- Rename the music_path directory to a unique, non-prefix-collision name as a temporary stopgap until patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
