{"id":"GO-2026-5825","revision":"2c5995abf6bf4402b8531a240d71a737","records":[{"revision":"2c5995abf6bf4402b8531a240d71a737","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5825","aliases":["CVE-2026-49339","GHSA-2fp4-5v5c-4448"],"title":"gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic","description":"gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:00:21.4684925+00:00","affected":[{"ecosystem":"Go","name":"go.senan.xyz/gonic","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448","https://nvd.nist.gov/vuln/detail/CVE-2026-49339","https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5825","license":"OSV · upstream source license applies","key":"osv:GO-2026-5825","identifiers":["GO-2026-5825","CVE-2026-49339","GHSA-2fp4-5v5c-4448"]},"retained":false,"historicalAffected":[]}],"coverage":[]}