Path Traversal in Sockso Project Music Host Server
CVE-2012-10061
Sockso Music Host Server versions <= 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem. The vulnerability exists in the HTTP interface on port 4444, where the endpoint /file/ fails to properly sanitize user-supplied input. Attackers can traverse directories and access sensitive files outside the intended web root.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.012 (68.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Sockso Project Music Host Server — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- web.archive.org/web/20120326095835/http://sockso.pu-gh.com/ (product, patch)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/… (exploit)
- github.com/rodnaph/sockso (product)
- aluigi.altervista.org/adv/sockso_1-adv.txt (technical-description, exploit)
- www.exploit-db.com/exploits/18605 (exploit)
- www.vulncheck.com/advisories/sockso-music-host-server-path-traversal (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10061?
- CVE-2012-10061 is a vulnerability in Sockso Project Music Host Server, classified under Path Traversal. Published 2025-08-20.
- Is CVE-2012-10061 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.