Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the loca…

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in the local storage plugin. The vulnerability exists in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 functions where user-supplied URIs are joined with storage root paths without proper canonicalization. This allows '..' segments to survive and enables directory traversal attacks. Unauthenticated attackers can exploit this using the listfiles command to enumerate arbitrary directories and the albumart command to read image files outside the configured music directory. The flaw affects any directories readable by the MPD process.