Zetlyn
GitHubGet started

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This...

zetlyn/cve-ghsa vulnerability ghsa GHSA-498x-cx6c-63cf cve CVE-2026-101036 known 2026-09-28

https://github.com/advisories/GHSA-498x-cx6c-63cf

Properties

cvss5.3
receipt
Source
GitHub advisories
Its words
5.3
Read by
field:cvss.score
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101036",
  "cvss": {
    "score": 5.3,
    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 5.3,
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 1.9,
      "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.0021,
    "percentile": 0.10118
  },
  "ghsa_id": "GHSA-498x-cx6c-63cf",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-498x-cx6c-63cf",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-498x-cx6c-63cf"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101036"
    }
  ],
  "nvd_published_at": "2026-09-28T10:16:42Z",
  "published_at": "2026-09-28T12:31:04Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101036",
    "https://allannjuguna.github.io/blog/flb_music/flb_music_player",
    "https://vuldb.com/cve/CVE-2026-101036",
    "https://vuldb.com/submit/926475",
    "https://vuldb.com/vuln/410904",
    "https://vuldb.com/vuln/410904/cti",
    "https://github.com/advisories/GHSA-498x-cx6c-63cf"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T12:31:13Z",
  "url": "https://api.github.com/advisories/GHSA-498x-cx6c-63cf",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-22
receipt
Source
GitHub advisories
Its words
CWE-22
Read by
field:cwes[].cwe_id
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101036",
  "cvss": {
    "score": 5.3,
    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 5.3,
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 1.9,
      "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.0021,
    "percentile": 0.10118
  },
  "ghsa_id": "GHSA-498x-cx6c-63cf",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-498x-cx6c-63cf",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-498x-cx6c-63cf"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101036"
    }
  ],
  "nvd_published_at": "2026-09-28T10:16:42Z",
  "published_at": "2026-09-28T12:31:04Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101036",
    "https://allannjuguna.github.io/blog/flb_music/flb_music_player",
    "https://vuldb.com/cve/CVE-2026-101036",
    "https://vuldb.com/submit/926475",
    "https://vuldb.com/vuln/410904",
    "https://vuldb.com/vuln/410904/cti",
    "https://github.com/advisories/GHSA-498x-cx6c-63cf"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T12:31:13Z",
  "url": "https://api.github.com/advisories/GHSA-498x-cx6c-63cf",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severitylow
Below 4.0.
receipt
Source
GitHub advisories
Its words
low
Read by
field:severity
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101036",
  "cvss": {
    "score": 5.3,
    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 5.3,
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 1.9,
      "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-22",
      "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    }
  ],
  "description": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.0021,
    "percentile": 0.10118
  },
  "ghsa_id": "GHSA-498x-cx6c-63cf",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-498x-cx6c-63cf",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-498x-cx6c-63cf"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101036"
    }
  ],
  "nvd_published_at": "2026-09-28T10:16:42Z",
  "published_at": "2026-09-28T12:31:04Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101036",
    "https://allannjuguna.github.io/blog/flb_music/flb_music_player",
    "https://vuldb.com/cve/CVE-2026-101036",
    "https://vuldb.com/submit/926475",
    "https://vuldb.com/vuln/410904",
    "https://vuldb.com/vuln/410904/cti",
    "https://github.com/advisories/GHSA-498x-cx6c-63cf"
  ],
  "repository_advisory_url": null,
  "severity": "low",
  "source_code_location": "",
  "summary": "A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T12:31:13Z",
  "url": "https://api.github.com/advisories/GHSA-498x-cx6c-63cf",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This... A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.