PatchTheCVECVE-2026-26975: Music Assistant is an open-source media library manager that integrates streaming services with connected spea
CVE-2026-26975 is a high-severity flaw (CVSS 8.8) affecting music assistant server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass the .m3u extension enforcement and write files anywhere on the filesystem, which is exacerbated by the container running as root. This can be exploited t
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-26975?
music assistant server: upgrade to 2.7.0. Exact commands for each OS are on this page.
Is CVE-2026-26975 being exploited?
CVE-2026-26975 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-26975 affect?
CVE-2026-26975 affects music assistant server. Severity is high (CVSS 8.8). Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installation
How urgent is CVE-2026-26975?
Priority 55/100. High severity; Public exploit reference