CVE-2026-97378 in server

Prediction

by VulDB Data Team • 10/20/2026

A vulnerability was found in <a href="/product/music-assistant:server">music-assistant server up to 2.9.5</a>. Impacted is the function <code>is_safe_path</code> of the file <em>music_assistant/helpers/security.py</em> of the component <em>imageproxy</em>. Performing a manipulation of the argument <em>path</em> results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2.9.6 is recommended to address this issue. The patch is named <em>efb657f7db683bfc31c04e1c0db94a6556a676e9</em>. It is recommended to upgrade the affected component.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Moderation: accepted
• Entry: VDB-422758
• CWE: CWE-22 (confirmed)
• Exploit: Download
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-97378
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97378
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-97378/