CVE-2026-49340 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Authenticated users can write arbitrary files to the host filesystem via path traversal in playlist creation, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49340?
CVE-2026-49340 is a high-severity path traversal vulnerability in sentriz gonic, published on 19 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with `0o777` permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in `Store.Write`. Version 0.21.0 patches the issue.
Which versions are affected by CVE-2026-49340?
3 open source packages ship an affected version, including go.senan.xyz/gonic.
| Package | Affected | Fixed in |
|---|---|---|
go.senan.xyz/gonic Go | All versions | 0.21.0 |
go.senan.xyz/gonic Go | All versions | 0.21.0 |
go.senan.xyz/gonic Go | All versions | 0.21.0 |
How do I fix CVE-2026-49340?
Upgrade go.senan.xyz/gonic to 0.21.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49340 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49340 exists.
Sources
Also known as GHSA-4gxv-p5g5-j7w7, GO-2026-5827.