High severity8.1NVD Advisory· Published Jun 19, 2026· Updated Jun 23, 2026

CVE-2026-49340

Description

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in ServeCreateOrUpdatePlaylist allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with 0o777 permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in Store.Write. Version 0.21.0 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
go.senan.xyz/gonicGo	< 0.21.0	0.21.0

Affected products

Sentriz/gonicllm-fuzzy
Range: <0.21.0
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-4gxv-p5g5-j7w7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-49340ghsaADVISORY
github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000