CVE-2026-49340: gonic Path Traversal Vulnerability

CVE-2026-49340 Overview

CVE-2026-49340 is a path traversal vulnerability [CWE-22] in gonic, a free-software Subsonic API music streaming server. The flaw resides in the ServeCreateOrUpdatePlaylist handler. Any authenticated Subsonic user, including non-administrative accounts, can write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host. The handler also creates intermediate directories with 0o777 permissions, broadening downstream exposure. The root cause is an unreachable guard clause combined with missing path containment in Store.Write. Version 0.21.0 patches the issue.

Critical Impact
Authenticated low-privilege users can write attacker-controlled files to arbitrary filesystem locations on the gonic host, enabling configuration tampering, log poisoning, and potential code execution paths.

Affected Products

gonic music streaming server prior to version 0.21.0
Subsonic API implementations bundled with affected gonic releases
Hosts running gonic with multi-user authentication enabled

Discovery Timeline

2026-06-19 - CVE-2026-49340 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49340

Vulnerability Analysis

The vulnerability exists in the ServeCreateOrUpdatePlaylist endpoint of the Subsonic API surface exposed by gonic. The handler accepts playlist data from authenticated users and writes M3U content to disk through Store.Write. A guard clause intended to validate the destination path is unreachable in the current control flow, so the validation never executes against user input.

Because Store.Write performs no path containment checks, the destination is treated as an absolute filesystem path under attacker control. The function also calls directory creation logic that produces intermediate directories with 0o777 permissions, granting world-writable access to any path component the attacker introduces.

The vulnerability is independent of CVE-2026-49338 and CVE-2026-49339, which affect separate code paths in the same project. Authentication is required, but no administrative role is needed. Any standard Subsonic user account is sufficient.

Root Cause

The root cause is a logic error in the playlist handler. A guard clause that should reject paths escaping the playlist directory is positioned where it cannot be reached during normal request processing. The downstream Store.Write function assumes upstream validation occurred and therefore does not sanitize, normalize, or constrain the supplied path to a designated base directory.

Attack Vector

An authenticated attacker issues a crafted createPlaylist or updatePlaylist Subsonic API request containing an absolute path as the playlist identifier or filename parameter. The server writes the M3U body to that path, creating intermediate directories with 0o777 permissions as needed. The vulnerability enables overwriting configuration files, dropping cron entries, poisoning logs, or planting files in directories consumed by other services running as the gonic user.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-4gxv-p5g5-j7w7.

Detection Methods for CVE-2026-49340

Indicators of Compromise

M3U files appearing outside the configured gonic playlist directory, particularly in system paths such as /etc, /var/spool/cron, or user home directories
Directories created with 0o777 (world-writable) permissions owned by the gonic service account
Subsonic API requests to createPlaylist or updatePlaylist containing absolute paths or ../ sequences in playlist parameters

Detection Strategies

Inspect gonic HTTP access logs for createPlaylist and updatePlaylist requests with suspicious name, playlistId, or filename parameters containing /, \, or path traversal sequences
Audit the filesystem for newly created files with .m3u content signatures located outside the gonic data directory
Correlate authenticated low-privilege Subsonic sessions with unexpected file creation events on the host

Monitoring Recommendations

Enable filesystem auditing on directories adjacent to the gonic data path and on sensitive system directories
Alert on any process running as the gonic user creating directories with mode 0777
Log and review all Subsonic playlist API calls, retaining request parameters for forensic correlation

How to Mitigate CVE-2026-49340

Immediate Actions Required

Upgrade gonic to version 0.21.0 or later, which contains the patched ServeCreateOrUpdatePlaylist handler and path containment in Store.Write
Audit existing user accounts and disable any that are not required, reducing the population of authenticated principals able to invoke the vulnerable endpoint
Review the gonic host for unauthorized files and 0o777 directories created since the service was deployed

Patch Information

The maintainers released gonic version 0.21.0 to address CVE-2026-49340. The fix repositions the guard clause so path validation executes on user-supplied input and adds path containment within Store.Write so writes are restricted to the configured playlist directory. Refer to the GitHub Security Advisory GHSA-4gxv-p5g5-j7w7 for commit-level details.

Workarounds

Restrict network access to the gonic Subsonic API to trusted users until the upgrade is applied
Run the gonic process under a dedicated unprivileged user with a restrictive umask and minimal filesystem write permissions outside its data directory
Place the gonic service inside a container or sandbox that limits writable paths to the playlist directory only

bash

# Configuration example: run gonic with restricted filesystem scope via systemd
[Service]
User=gonic
Group=gonic
UMask=0027
ReadWritePaths=/var/lib/gonic
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true