HIGH7.1Go
GHSA-2fp4-5v5c-4448· CVE-2026-49339, GO-2026-5825gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
Modified: 7/7/2026
package
Go/go.senan.xyz/gonic
pkg:go/go.senan.xyz/gonic
HIGH8.1Go
GHSA-4gxv-p5g5-j7w7· CVE-2026-49340, GO-2026-5827gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
Modified: 7/7/2026
HIGH7.1Go
GHSA-hmgp-w9jm-vp95· CVE-2026-49338, GO-2026-5830Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Modified: 7/7/2026
—Go
GO-2026-5825· CVE-2026-49339, GHSA-2fp4-5v5c-4448gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic
Modified: 7/7/2026
—Go
GO-2026-5827· CVE-2026-49340, GHSA-4gxv-p5g5-j7w7gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host in go.senan.xyz/gonic
Modified: 7/7/2026
—Go
GO-2026-5830· CVE-2026-49338, GHSA-hmgp-w9jm-vp95Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) in go.senan.xyz/gonic
Modified: 7/7/2026