Threats affecting pkg:pypi/Mopidy

Mopidy versions before 4.0.5 contain a path traversal vulnerability that allows unauthenticated clients to access local files outside the intended directories. This occurs because the FileLibraryProvider.lookup() method does not properly restrict file paths, enabling attackers to use JSON-RPC or WebSocket calls with file:// URIs to read files and metadata outside the sandbox.