The vulnerability CVE-2026-49340 affects sentriz gonic versions before 0.21.0. It is caused by improper limitation of a pathname to a restricted directory (CWE-22) due to a logic error in the ServeCreateOrUpdatePlaylist function. Authenticated users can exploit this to write playlist files to arbitrary absolute paths on the server filesystem and create directories with insecure permissions (0o777). This occurs because a guard clause intended to prevent such writes is unreachable, and the Store.Write method does not enforce path containment. This vulnerability is distinct from CVE-2026-49338 and CVE-2026-49339. The issue is fixed in version 0.21.0.

Exploitation allows any authenticated Subsonic user to write arbitrary playlist M3U content to any absolute filesystem path on the gonic host, potentially overwriting or creating files outside intended directories. Additionally, attackers can create intermediate directories with full permissions (0o777), increasing the risk of unauthorized file access or modification. This can lead to integrity and availability impacts on the host system. Confidentiality impact is not indicated. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

A fix is available in sentriz gonic version 0.21.0, which patches this path traversal vulnerability. Users should upgrade to version 0.21.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.