CVE-2026-23877 Directory Traversal & Filesystem can be accessed by a non-admin user
Authenticated non-admin users can browse arbitrary server directories via a directory traversal flaw in the folder browser endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23877?
CVE-2026-23877 is a medium-severity path traversal vulnerability in swingmx swingmusic, published on 19 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.
Which versions are affected by CVE-2026-23877?
3 open source packages ship an affected version, including swingmusic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
swingmusic PyPI | All versions | 2.1.4 |
swingmusic PyPI | All versions | 2.1.4 |
swingmusic PyPI | All versions | 2.1.4 |
Products include Swingmx Swing Music.
How do I fix CVE-2026-23877?
Upgrade swingmusic to 2.1.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23877 being exploited?
There is no known exploitation of CVE-2026-23877 in the wild and no public exploit code.
Sources
Also known as GHSA-pj88-9xww-gxmh, PYSEC-2026-1947.