Cantata, a client for Music Player Daemon, was found to have a security flaw, where it allows attacker to download any readable file on the system.

It starts internal http server on external network interface by default, and it's not possible to disable http server, it was found that cantata checks for two things:

1. User-Agent in http/httpsocket.cpp:
	if (str.startsWith("User-Agent:") && str.contains("Music Player Daemon")) {
            return true;
        }

2. 'cantata=song' in url in http/httpserver.cpp:
	if (q.hasQueryItem("cantata") && q.queryItemValue("cantata")=="song")

So, anyone can craft a simple command based on these two criterias and can download any file targeted, which cantata allows.

References:
https://bugs.gentoo.org/show_bug.cgi?id=495182