{"action":"Upgrade swingmusic to 2.1.4 or later.","affected":[{"fixed":"2.1.4","introduced":"0"}],"component":"swingmusic","cve_ids":["CVE-2026-23877"],"ecosystem":"PyPI","epss":0.00595,"exploited":false,"fixed_versions":["2.1.4"],"ghsa_id":"GHSA-pj88-9xww-gxmh","id":"tcs_01M5KFT80KMCM7SKMC24WWAAJY","modified_at":"2026-07-07T17:56:38.309315644Z","published_at":"2026-01-21T01:02:29Z","references":["https://osv.dev/vulnerability/GHSA-pj88-9xww-gxmh","https://github.com/swingmx/swingmusic/security/advisories/GHSA-pj88-9xww-gxmh","https://nvd.nist.gov/vuln/detail/CVE-2026-23877","https://github.com/swingmx/swingmusic/commit/9a915ca62af1502b9550722df82f5d432cb73de3","https://github.com/swingmx/swingmusic"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-pj88-9xww-gxmh","url":"https://osv.dev/vulnerability/GHSA-pj88-9xww-gxmh"},{"source":"nvd","source_id":"CVE-2026-23877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23877"}],"summary":"Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user"}