5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23877

CVE-2026-23877: Directory Traversal & Filesystem can be accessed by a non-admin user

Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's list_folders() function in the /folder/dir-browser endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23877

CVE-2026-23877:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
swingmusic	pip	< 2.1.4	2.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is improper path handling across multiple functions in src/swingmusic/api/folder.py. The primary vulnerable function, as detailed in the advisory, is list_folders, which is exposed via the /folder/dir-browser API endpoint. It allowed any authenticated user to browse the server's entire filesystem due to a flawed path existence check that enabled directory traversal attacks. An input like ../../../../etc would be processed and allow listing of the /etc directory.

The analysis of the patch 9a915ca62af1502b9550722df82f5d432cb73de3 reveals that this directory traversal vulnerability pattern existed in three other functions as well: get_folder_tree, open_in_file_manager, and get_tracks_in_path. All these functions accepted a path from the user and used it without proper sanitization or validation, making them vulnerable to traversal attacks.

The fix was comprehensive:

For list_folders, access was restricted to administrators only via the @admin_required decorator, and path resolution was implemented.
For all four functions, the user-provided path is now resolved to its absolute, canonical path using pathlib.Path().resolve(), which neutralizes ../ sequences.
For get_folder_tree, open_in_file_manager, and get_tracks_in_path, a new validation function, is_path_within_root_dirs, was introduced to ensure the resolved path is within the user-configured music directories, preventing access to arbitrary filesystem locations.

Therefore, during exploitation, any of these four functions could appear in a runtime profile as they process the malicious path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.