CVE-2026-49130 Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
Attackers can inject CRLF sequences into MPD protocol responses and state files via malicious XSPF playlists, potentially corrupting data or misleading clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49130?
CVE-2026-49130 is a medium-severity vulnerability in MusicPlayerDaemon MPD, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
Weakness: CWE-93
Which versions are affected by CVE-2026-49130?
How do I fix CVE-2026-49130?
Upgrade to a fixed version.
Is CVE-2026-49130 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49130 exists.
Sources
Also known as DEBIAN-CVE-2026-49130, GHSA-f8fv-fv9m-8539, UBUNTU-CVE-2026-49130.