CVE-2026-49340 - gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
CVE ID :CVE-2026-49340 Published : June 19, 2026, 7:11 p.m. | 3 hours, 58 minutes ago Description :gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` allows any authenticated Subsonic...