ZDI 2026-03-03

ZDI-26-133: (Pwn2Own) Music Assistant _update_library_item External Control of File Path Remote Code Execution Vulnerability

CVE-2026-26975

Machine-generated analysis · WAYSCloud LLM

The vulnerability involves external control of a file path in Music Assistant's _update_library_item function, enabling remote code execution without authentication.

Context

Music Assistant is affected by a vulnerability in the _update_library_item function. The issue stems from external control of file path, allowing remote code execution. Authentication is not required to exploit this vulnerability. The ZDI assigned a CVSS rating of 8.8, indicating high severity based on exploitability and impact potential.

Operator considerations

Check: Identify instances of Music Assistant that are network-adjacent and exposed to untrusted networks.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Music Assistant. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-26975.

Read the full advisory on ZDI →