Skip to content
OpenAdvisories

Package · Debian

mpd

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-49130

    Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

    Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist wit…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu
  • Medium 5.8
    CVE-2026-49129

    Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

    Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https schem…

    MusicPlayerDaemon MPD mpd mpd Debian Ubuntu