swingmx vulnerabilities

Products

• swing music 1
• swingmusic 1

Latest swingmx CVEs

Newest publication first

1. CVE-2026-23877 Directory Traversal & Filesystem can be accessed by a non-admin user

   Published 2026-01-19

   Medium·CVSS 5.3 EPSS 0.60%

   Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's list_folders() function in the /folder/dir-browser endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary direc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.