Skip to content
OpenAdvisories

Package · Debian

mpd

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.3
    CVE-2026-49130

    Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

    Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist wit…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu
  • Medium 5.8
    CVE-2026-49129

    Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

    Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https schem…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu
  • High 7.5
    CVE-2026-49128

    Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

    Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-sup…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu
  • High 8.6
    CVE-2026-49127

    Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

    Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM deco…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu