CVE-2026-97378 | music-assistant server up to 2.9.5 imageproxy security.py is_safe_path path traversal (GHSA-hc8p-f7fx-828m)

October 20, 2026 Yanac

A vulnerability classified as problematic has been found in music-assistant server up to 2.9.5. Impacted is the function is_safe_path of the file music_assistant/helpers/security.py of the component imageproxy. Performing a manipulation of the argument path results in path traversal.

This vulnerability is reported as CVE-2026-97378. The attack is possible to be carried out remotely. Moreover, an exploit is present.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More