debian/mopidy vulnerabilities

Latest debian/mopidy CVEs

Newest publication first

1. CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

   Published 2026-10-19

   Medium·CVSS 6.9 EPSS 0.43%

   Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.