An unauthenticated path traversal vulnerability in Musicco 2.0.0 allows remote attackers to download sensitive system files, posing a severe risk to data confidentiality.

The application fails to properly sanitize the parent parameter within the getAlbum endpoint. This allows an unauthenticated attacker to inject directory traversal sequences, enabling the retrieval of arbitrary directories from the underlying file system.

Successful exploitation allows an unauthorized user to exfiltrate sensitive configuration files, source code, or system data. Given the CVSS score of 7.5, this high-severity vulnerability could lead to significant data breaches and total compromise of the application environment.

Immediate Action: As no official patch is documented, administrators should restrict access to the affected web application or disable the vulnerable getAlbum functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns, such as sequences of double dots and slashes, directed at the index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block directory traversal attempts targeting the parent parameter in URL queries.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID: 45830).

The presence of a publicly available exploit for this path traversal vulnerability significantly increases the risk of successful unauthorized access. Organizations currently running Musicco 2.0.0 should prioritize immediate mitigation through access controls or disabling the vulnerable endpoint, as the ability for an unauthenticated user to download arbitrary system directories represents an unacceptable security posture.