CVE-2026-10108 is a path traversal vulnerability (CWE-22) in hanxi xiaomusic v0.5.7. The vulnerability exists in the GET /music/{file_path:path} endpoint where an incomplete path prefix check fails to properly restrict file access. Specifically, the check does not include a trailing separator in the comparison logic, enabling attackers to craft traversal sequences that bypass the restriction and read arbitrary files outside the intended music directory without authentication.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server outside the designated music directory. This can lead to unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious requests attempting path traversal sequences. Avoid exposing the service publicly if possible.