CVE-2026-118577

    Dashboard / Vulnerabilities / CVE-2026-118577

    CVE-2026-118577

    Published: 28 Oct 2026Last Modified: 4 Nov 2026

    Summary: maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

    Details: A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

    References: https://github.com/maotoumao/MusicFreeDesktop/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118577.json, https://nvd.nist.gov/vuln/detail/CVE-2026-118577, https://vuldb.com/cve/CVE-2026-118577, https://vuldb.com/submit/1025070, https://vuldb.com/vuln/428016, https://github.com/maotoumao/MusicFreeDesktop/issues/443, https://vuldb.com/vuln/428016/cti, https://github.com/maotoumao/MusicFreeDesktop/commit/b0d3876247a0a64fa0e430e4b21870e41f503182

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7c8bd0ad94d3d77ee364a95362dcde34d7e172ff
    Fixed -b0d3876247a0a64fa0e430e4b21870e41f503182

    Affected versions

    0.0.6
    0.0.7
    0.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118577 | CVE-DB