CVE-2026-49129

MEDIUM 5.8

Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

CVSS Score

5.8

EPSS Score

0.0%

EPSS Percentile

14th

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.

CWE	CWE-918
Vendor	musicplayerdaemon
Product	mpd
Published	May 28, 2026
Last Updated	May 29, 2026

Stay Ahead of the Next One

Get instant alerts for musicplayerdaemon mpd

Be the first to know when new medium vulnerabilities affecting musicplayerdaemon mpd are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

MusicPlayerDaemon / MPD

0 < 0.24.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

mstreet97.github.io: https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html musicpd.org: https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ raw.githubusercontent.com: https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS github.com: https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 github.com: https://github.com/MusicPlayerDaemon/MPD/issues/2487 github.com: https://github.com/MusicPlayerDaemon/MPD/commit/78341dd6c7b101c3feede233d4cc4f8f1fcc4bb3 vulncheck.com: https://www.vulncheck.com/advisories/music-player-daemon-ssrf-via-curlinputplugin

Credits

Matteo Strada Daniele Berardinelli