Description
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| swingmx | swingmusic | < 2.1.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | swingmusic | < 2.1.4 | 2.1.4 | GHSA-pj88-9xww-gxmh |