CVE-2026-49339

## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist`) added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the *first path segment* of the attacker-controlled playlist ID, with no path containment on the resolved file path. **Any authenticated Subsonic user** can therefore bypass the ownership check and: 1. **Read any other user's playlist** (name, comment, IsPublic flag, song list) by crafting a base64-encoded playlist ID whose first segment matches their own user ID, followed by `..` traversal segments pointing into another user's playlist directory. 2. **Delete any other user's playlist** (including admin's curated playlists) by the same trick against `deletePlaylist`. 3. **Probe arbitrary file paths on the host** for existence/readability. This is a bypass of the boundary the 6dd71e6 fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). ## Root cause `server/ctrlsubsonic/handlers_playlist.go::playlistIDDecode` performs raw base64 decode of the `id` parameter and passes the byte string straight to `playlistStore.Read/Delete`: ```go func playlistIDDecode(id specid.ID) string { path, _ := base64.URLEncoding.DecodeString(id.StringValue) return string(path) } ``` `playlist/playlist.go::Store.Read` then: ```go absPath := filepath.Join(s.basePath, relPath) // no containment check // ... playlist.UserID, err = userIDFromPath(relPath) // extracts firstPathEl, e.g. "2" if err != nil { playlist.UserID = 1 // fallback } ``` `userIDFromPath` reads only the first segment via `firstPathEl(relPath)` (`strconv.Atoi` of `strings.Split(path, "/")[0]`). It does not validate that the cleaned absolute path st