CVE-2026-101036
Received Received - Intake

Path Traversal in FLB-Music Player

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101036
EUVD
EUVD-2026-88198

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
flb-music flb-music-player From 1.1.8 (inc) to 1.2.1 (inc)
flb-music flb-music-player 1.1.8
flb-music flb-music-player 1.1.9
flb-music flb-music-player 1.2.0
flb-music flb-music-player 1.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101036 is a path traversal vulnerability in FLB-Music-Player versions 1.1.8 to 1.2.1. It occurs in the path.join function of /src/main/core/createParsedTrack.ts. The issue allows attackers to manipulate file paths by injecting traversal sequences into MIME types of MP3 metadata, leading to writes in unintended filesystem locations.

Detection Guidance

To detect this vulnerability, inspect MP3 files in directories monitored by FLB-Music-Player for suspicious APIC frames. Check for MIME types containing path traversal sequences like 'image/png/../../../../../'. Use commands like 'find / -name "*.mp3" -exec grep -l "image/" {} \;' to search for MP3 files and examine their metadata.

Impact Analysis

This vulnerability enables attackers to write files to arbitrary locations on the system. This could allow overwriting critical files like SSH keys, configuration files, or Python modules. On Linux/macOS, attackers could modify ~/.bashrc or site-packages .pth files to execute malicious Python code when the interpreter starts.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized file writes to sensitive locations. An attacker could overwrite configuration files, logs, or other critical data, leading to data breaches or unauthorized access. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information; this flaw could undermine those protections.

Mitigation Strategies

Immediately update FLB-Music-Player to a patched version if available. If not, disable the application or remove its ability to process MP3 files. Restrict write permissions to directories where album art is saved. Monitor filesystem changes for unauthorized writes to critical files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart