---
id: CVE-2026-49129
title: Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
summary: >-
  Music Player Daemon (MPD) before version 0.24.11 contains a server-side
  request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION
  is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers
  to bypas…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: MusicPlayerDaemon
product: MPD
affected:
  - MPD < 0.24.11
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-29T13:57:31.095277Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:43.408Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49129'
references:
  - url: >-
      https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html
  - url: 'https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/'
  - url: 'https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS'
  - url: 'https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11'
    label: MPD 0.24.11 Release Notes
  - url: 'https://github.com/MusicPlayerDaemon/MPD/issues/2487'
  - url: >-
      https://github.com/MusicPlayerDaemon/MPD/commit/78341dd6c7b101c3feede233d4cc4f8f1fcc4bb3
  - url: >-
      https://www.vulncheck.com/advisories/music-player-daemon-ssrf-via-curlinputplugin
tags:
  - cve.org
  - exploit-available
epss: 0.00281
epssPercentile: 0.20718
ingestedAt: '2026-11-08T14:51:22.390Z'
---

## Overview

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.

## Affected

- `MPD < 0.24.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.