Path Traversal in Sockso Project Music Host Server
CVE-2012-10061
Sockso Music Host Server versions <= 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize user-supplied input. Attackers can traverse directories and access sensitive files outside the intended web root.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.012 (66.3th percentile) — read the EPSS interpretation.
Affected products
- Sockso Project Music Host Server — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (product, patch)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10061?
- CVE-2012-10061 is a vulnerability in Sockso Project Music Host Server, classified under Path Traversal. Published 2025-08-20.
- Is CVE-2012-10061 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.