CVE-2026-49128 is a path traversal vulnerability in Music Player Daemon (MPD) prior to version 0.24.11. The issue exists in the LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 functions within the local storage plugin, where the on-disk path is constructed by concatenating the storage root with a user-supplied URI as plain strings without canonicalization. This allows '..' path segments to persist and be resolved by the kernel at openat() time, enabling an unauthenticated attacker to enumerate arbitrary directory contents and read image files outside the configured music directory using the listfiles and albumart commands.

An unauthenticated attacker can exploit this vulnerability to enumerate names, sizes, and modification times of arbitrary directories accessible by the MPD process. Additionally, the attacker can read image files from any directory outside the configured music directory. This leads to unauthorized information disclosure, potentially exposing sensitive file metadata and contents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MPD service to trusted networks and users to reduce exposure. Monitor for updates from the Music Player Daemon project regarding patches or official mitigations.