Skip to content
OpenAdvisories

Vendor

sentriz

4 known vulnerabilities.

Products

gonic 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-49340

    gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

    gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an atta…

    sentriz gonic go.senan.xyz/gonic Go
  • High 7.1
    CVE-2026-49338

    Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

    gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any…

    sentriz gonic go.senan.xyz/gonic Go
  • High 7.1
    CVE-2026-49339

    Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist

    gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the…

    sentriz gonic go.senan.xyz/gonic Go