Here’s your Medium article draft on CVE-2026–10108.

CVE-2026–10108: Unauthenticated Path Traversal in xiaomusic Exposes Server Files

A newly disclosed high-severity vulnerability in xiaomusic v0.5.7 allows attackers to read arbitrary files from a server without any authentication, simply by exploiting a flaw in how the application validates file paths.[nvd.nist]

What Is xiaomusic

xiaomusic is a music streaming application that serves audio files to users through a web-based API. Like many self-hosted media servers, it relies on restricting file access to a designated music directory to prevent users from browsing or reading unrelated files on the host system.[nvd.nist]

The Vulnerability Explained

The flaw lives in the GET /music/{file_path:path} endpoint, which is meant to serve files only from within the configured music_path directory. The application checks whether a requested file path starts with the string of the music directory, but it fails to append a trailing separator (such as a slash) when performing that comparison.[cvefeed]

This missing separator creates a classic prefix-matching bug. If the music directory is, for example, /data/music, the flawed check will also accept any path that merely starts with those characters — including a sibling directory like /data/music_backup or /data/musicprivate — because the string /data/music is a valid prefix of both, even though they are completely different directories.[nvd.nist]

How an Attacker Exploits It

By crafting path traversal sequences (like ../) combined with directory names that share the music_path prefix, an unauthenticated attacker can pivot out of the intended music folder and read arbitrary files elsewhere on the server. Because no authentication is required, this attack can be launched by anyone with network access to the exposed endpoint, making it especially dangerous for internet-facing deployments.[cvefeed]

Severity and Scoring

The vulnerability was assigned a CVSS 4.0 base score of 8.7, rated HIGH, reflecting its network attack vector, low complexity, and lack of required privileges or user interaction. The vector string AV:N/AC:L/AT:N/PR:N/UI:N/VC:H confirms that confidentiality impact is high, since sensitive files such as configuration data, credentials, or logs could be exposed to a remote, unauthenticated attacker.[nvd.nist]

AttributeDetailAffected softwarexiaomusic v0.5.7 [nvd.nist]Vulnerable endpointGET /music/{file_path:path} [nvd.nist]Vulnerability typePath traversal / arbitrary file read [nvd.nist]CVSS 4.0 score8.7 (High) [nvd.nist]Authentication requiredNone [nvd.nist]CNA / SourceVulnCheck [nvd.nist]PublishedMay 29, 2026 [cvefeed]

Root Cause: A Missing Separator

This bug falls into a well-known category of path traversal flaws caused by naive string-prefix checks instead of proper path normalization and boundary validation. Developers often assume that checking if path.startswith(base_dir) is sufficient to constrain access, but without appending the OS path separator to base_dir before the comparison, any directory whose name simply begins with the same characters can slip through the check.[cvefeed]

Remediation Guidance

Fixing this class of vulnerability requires more than a quick patch — it demands rethinking how paths are validated.

• Update xiaomusic to a patched version once the maintainers release a fix for the flawed comparison logic.[cvefeed]
• Always append the OS-specific trailing separator to the base directory string before performing prefix comparisons.[nvd.nist]
• Normalize and resolve paths (eliminating ../ sequences) before validating them against the allowed directory.[cvefeed]
• Use dedicated path-containment libraries or functions rather than manual string comparisons.
• Restrict network exposure of media server endpoints, placing them behind authentication or a reverse proxy where possible.[cvefeed]

Why This Matters for Self-Hosted Media Servers

Path traversal vulnerabilities remain one of the most persistent bug classes in web applications, and self-hosted tools like xiaomusic are increasingly popular targets since they're often deployed on home networks or lightly monitored VPS instances. With a public CVE now assigned and proof-of-concept activity being tracked on platforms like cvefeed.io, defenders should prioritize identifying and patching exposed instances before automated scanners begin targeting this flaw at scale.[cvefeed]