---
id: CVE-2026-10108
title: >-
  xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in
  the GET /music/{file_path:path} endpoint that allows unauthenticated attackers
  to read arbitrary files outside the intended music directory by exploiting an
  inc…
summary: >-
  xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in
  the GET /music/{file_path:path} endpoint that allows unauthenticated attackers
  to read arbitrary files outside the intended music directory by exploiting an
  inc…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: hanxi
product: xiaomusic
affected:
  - xiaomusic <= 0.5.7
  - xiaomusic <= 88404da7a283f2c0a796a4cd16bbb6e6aa1f4722
patched:
  - xiaomusic 0.5.8
published: '2026-05-29'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:06.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10108'
references:
  - url: >-
      https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722
    label: disclosure@vulncheck.com
  - url: 'https://github.com/hanxi/xiaomusic/issues/890'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/hanxi/xiaomusic/pull/891'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xiaomusic-path-traversal-via-get-music-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/hanxi/xiaomusic/issues/890'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10108'
  - url: 'https://github.com/hanxi/xiaomusic'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - pip
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-01T13:28:29.160852Z'
epss: 0.00652
epssPercentile: 0.51051
aliases:
  - GHSA-5j8p-5rrj-8wjg
ecosystem: pip
ingestedAt: '2026-07-08T18:25:46.017Z'
---

## Overview

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from sibling directories whose names share the music_path prefix by crafting traversal sequences, bypassing the path restriction due to the missing trailing separator in the comparison logic to retrieve arbitrary files from the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-10108)

Affected packages:

- `xiaomusic < 0.5.8`

Patched in:

- `xiaomusic 0.5.8`

Source: https://osv.dev/vulnerability/GHSA-5j8p-5rrj-8wjg