Music Assistant protects files from being overwritten through playlist editing. A playlist reference could previously point to any regular file inside a Local files source, causing an add-tracks request to append playlist text to it. With an administrator’s access and a suitably located file, the source describes a path to code execution.
Marvin Schenkel limits those operations to playlist files and verifies a provider mapping before adding it. A related correction refuses to follow symbolic links while writing a playlist, preventing the destination from escaping its configured folder. Imported playlist artwork also stops accepting local file paths.