The vulnerability arises from a logic error in the ServeCreateOrUpdatePlaylist function of gonic before version 0.21.0. An unreachable guard clause combined with lack of path containment checks in Store.Write allows authenticated Subsonic users to perform path traversal and write playlist files to attacker-controlled absolute paths on the server filesystem. Additionally, intermediate directories can be created with world-writable permissions (0o777). This issue is distinct from other CVEs affecting gonic and is resolved in version 0.21.0.

Exploitation allows any authenticated user to write arbitrary playlist files to any location on the server filesystem where the gonic process has write permissions. This can lead to unauthorized file creation or modification, potentially enabling further attacks or service disruption. The creation of directories with 0o777 permissions increases the risk of unauthorized access or tampering by other users or processes on the host. The CVSS score of 8.1 reflects high impact due to integrity and availability consequences.

Upgrade gonic to version 0.21.0 or later, where this path traversal vulnerability is patched. No other mitigations are indicated by the vendor advisory. Patch status is not explicitly stated but the fix is included in version 0.21.0.