PT-2026-39326 · Unknown · Streamlink
4Tkd0G
·
Published
2026-05-07
·
Updated
2026-06-01
·
CVE-2026-44353
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
streamlink versions prior to 8.4.0
Description
Streamlink's HLS and DASH parsers fail to validate the URI scheme of segment entries and other resources. A remote attacker can host a malicious
.m3u8 HLS playlist or .mpd DASH manifest that lists local files using the file:/// scheme. When Streamlink processes such a manifest, it reads the specified local files—such as private keys, credentials, or system files like /etc/passwd—and writes their contents to the output stream or file. This occurs because segment URIs are passed to the worker without a scheme allowlist, and the underlying HTTP session accepts file:// URIs that resolve against the local filesystem.Recommendations
Update to version 8.4.0 or later.
As a temporary workaround, avoid processing HLS playlists or DASH manifests from untrusted or remote sources.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Streamlink