CVE-2026-23877: Swing Music Path Traversal Vulnerability

CVE-2026-23877 Overview

Swing Music, a self-hosted music player for local audio files, contains a directory traversal vulnerability in versions prior to 2.1.4. The list_folders() function in the /folder/dir-browser endpoint fails to properly sanitize user-supplied input, allowing authenticated users to browse arbitrary directories on the server filesystem beyond the intended music library paths.

Critical Impact

Any authenticated user, including those without administrative privileges, can exploit this vulnerability to enumerate and browse sensitive directories on the host system, potentially exposing configuration files, credentials, and other sensitive data.

Affected Products

• Swing Music versions prior to 2.1.4
• Self-hosted deployments with the /folder/dir-browser endpoint enabled
• Installations where authenticated users should have restricted filesystem access

Discovery Timeline

• 2026-01-19 - CVE-2026-23877 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23877

Vulnerability Analysis

This directory traversal vulnerability (CWE-25: Path Traversal) exists in Swing Music's folder browsing functionality. The list_folders() function processes user-supplied directory paths without adequate validation, enabling attackers to use path traversal sequences (such as ../) to escape the intended directory scope. The vulnerability requires network access and valid authentication credentials, though even non-administrative users can exploit it to access arbitrary filesystem locations.

The attack surface is limited to information disclosure rather than modification or denial of service, as the vulnerable endpoint only permits reading directory listings. However, this can reveal sensitive system information including the presence of configuration files, backup locations, database files, and other directories that should remain hidden from application users.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the list_folders() function. The endpoint accepts directory path parameters from authenticated users but fails to implement proper path canonicalization or containment checks. This allows attackers to construct requests containing directory traversal sequences that navigate outside the intended music library directories.

The fix implemented in version 2.1.4 addresses this by properly validating and sanitizing path inputs before processing directory listing requests.

Attack Vector

The vulnerability is exploited via network requests to the /folder/dir-browser endpoint. An attacker must first authenticate to the Swing Music application (any valid user account is sufficient). Once authenticated, the attacker crafts HTTP requests containing path traversal sequences in the directory parameter to enumerate arbitrary locations on the server filesystem.

For example, an attacker might manipulate the directory path parameter to traverse from the configured music directory up to system-level directories such as /etc/ or /home/, revealing sensitive configuration files and user data locations. Technical details and the specific fix can be found in the GitHub Security Advisory GHSA-pj88-9xww-gxmh.

Detection Methods for CVE-2026-23877

Indicators of Compromise

• HTTP requests to /folder/dir-browser containing ../ or encoded path traversal sequences such as %2e%2e%2f
• Directory browsing requests targeting system paths outside the configured music library directories
• Unusual access patterns from authenticated users attempting to enumerate sensitive filesystem locations
• Server logs showing repeated requests to the dir-browser endpoint with varying path parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal sequences in request parameters
• Monitor server access logs for requests to /folder/dir-browser containing suspicious path patterns
• Configure intrusion detection systems (IDS) to alert on directory traversal attack signatures targeting this endpoint
• Review application logs for failed or successful directory listing operations outside expected paths

Monitoring Recommendations

• Enable verbose logging for the Swing Music application to capture all directory browsing requests
• Set up alerts for any access attempts to system-critical directories such as /etc/, /root/, or /home/
• Implement file integrity monitoring on sensitive configuration files that could be discovered through this vulnerability
• Monitor network traffic for anomalous patterns of requests to the /folder/dir-browser endpoint

How to Mitigate CVE-2026-23877

Immediate Actions Required

• Upgrade Swing Music to version 2.1.4 or later immediately
• Audit application logs for evidence of exploitation attempts prior to patching
• Review user accounts and remove any unnecessary authenticated users
• Consider implementing network-level access controls to limit who can reach the Swing Music instance

Patch Information

The vulnerability is addressed in Swing Music version 2.1.4. The fix implements proper path validation to prevent directory traversal attacks. Administrators should update to this version or later to remediate the vulnerability. The security patch details can be reviewed in the GitHub commit 9a915ca.

Workarounds

• Restrict network access to the Swing Music instance using firewall rules to limit exposure to trusted users only
• Implement a reverse proxy with path filtering to block requests containing traversal sequences
• Temporarily disable or restrict access to the /folder/dir-browser endpoint if not essential for operations
• Review and minimize the number of authenticated user accounts to reduce the attack surface

# Example: Block path traversal attempts with nginx
location /folder/dir-browser {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    proxy_pass http://swingmusic_backend;
}