PT-2026-23044 · Elgato+1 · Elgato Stream Deck+1

Ambiso · Published 2026-03-04 · Updated 2026-03-05 · CVE-2026-28427

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenDeck versions prior to 2.8.1

Description OpenDeck is Linux software for the Elgato Stream Deck. The service listening on port 57118 serves static files for installed plugins without proper path sanitization. An attacker can use '../' sequences in the request path to traverse outside the intended directory and read arbitrary files accessible to OpenDeck. The vulnerable component serves static files for installed plugins.

Recommendations Update to OpenDeck version 2.8.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-24

CWE-22

Related Identifiers

CVE-2026-28427

GHSA-4974-G27Q-H5M8

Affected Products

Elgato Stream Deck

Opendeck

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28427.json · Exploit
• https://github.com/nekename/OpenDeck/security/advisories/GHSA-4974-g27q-h5m8 · Vendor Advisory
• https://github.com/nekename/OpenDeck/commit/488a52050017e95a72ba448226ac5e19a20dd9ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28427 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28427 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2029294677480948052 · Twitter Post
• https://t.me/cveNotify/154197 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029392692107501663 · Twitter Post
• https://twitter.com/CVEnew/status/2029292949255971068 · Twitter Post
• https://t.me/CVEtracker/46355 · Telegram Post