{"id":"EUVD-2026-38068","enisaUuid":"4b84b950-ee3e-3a0b-bfe1-eb8745ef0f00","description":"gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with `0o777` permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in `Store.Write`. Version 0.21.0 patches the issue.","datePublished":"Jun 19, 2026, 7:11:20 PM","dateUpdated":"Jun 22, 2026, 5:50:57 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7\n","aliases":"CVE-2026-49340\nGHSA-4gxv-p5g5-j7w7\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"5bf14121-0613-34e9-9cb8-318ad3428758","product":{"name":"gonic","vendor":{"name":"sentriz"}},"product_version":"\u003c 0.21.0"}],"enisaIdVendor":[{"id":"90e598f5-4885-32dc-907c-de5b4050355d","vendor":{"name":"sentriz"}}],"enisaIdVulnerability":[{"id":"45a95b47-8996-3746-aca3-536bdef8942c","vulnerability":{"id":"CVE-2026-49340","description":"gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic user (including non-admin) to write playlist M3U content to an attacker-controlled absolute filesystem path on the gonic host, and to create intermediate directories with `0o777` permissions. The bug is independent of CVE-2026-49338 and CVE-2026-49339. It is an unreachable guard clause combined with no path containment in `Store.Write`. Version 0.21.0 patches the issue.","datePublished":"Jun 19, 2026, 7:11:20 PM","dateUpdated":"Jun 22, 2026, 5:50:57 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7\n","enisa_id":"EUVD-2026-38068\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 7, 2026, 7:22:41 AM","vulnerabilityProduct":[{"id":"250bab53-60bc-3688-9fc6-c714396bd42a","product":{"name":"gonic","vendor":{"name":"sentriz"}},"product_version":"\u003c 0.21.0"}],"vulnerabilityVendor":[{"id":"2380ea53-1292-305e-beb4-081897b27380","vendor":{"name":"sentriz"}}]}},{"id":"737c794c-85cd-3755-b7ef-714a4819ece1","vulnerability":{"id":"GHSA-4gxv-p5g5-j7w7","description":"gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host","datePublished":"Jun 26, 2026, 11:21:42 PM","dateUpdated":"Jun 26, 2026, 11:21:42 PM","baseScore":0.0,"references":"https://github.com/sentriz/gonic/security/advisories/GHSA-4gxv-p5g5-j7w7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49340\nhttps://github.com/sentriz/gonic\n","enisa_id":"EUVD-2026-38068\n","aliases":"CVE-2026-49340\nGHSA-4gxv-p5g5-j7w7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}