CVE-2026-44353
Remote File Read via HLS/DASH in Streamlink
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| streamlink | streamlink | to 8.4.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Streamlink versions prior to 8.4.0, specifically in its HLS and DASH parsers. These parsers do not validate the URI scheme of segment entries and other resources in video stream playlists or manifests. As a result, a remote playlist or manifest file can include a segment with a file URI scheme (e.g., file:///path/to/file). Streamlink will then read the specified local file on the user's system and write its contents to the output stream, potentially exposing local files unintentionally.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of local files on the user's system. An attacker who controls or can influence the remote playlist or manifest can cause Streamlink to read and output local files, potentially exposing sensitive information. This can compromise confidentiality, as indicated by the CVSS score which rates the impact on confidentiality as high.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Streamlink to version 8.4.0 or later, where the issue with URI scheme validation in HLS and DASH parsers has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows remote attackers to cause Streamlink to read and output local files, potentially exposing sensitive information such as user credentials or configuration files.
Exposure of sensitive personal or confidential data through this vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access or disclosure.
Therefore, if exploited, this vulnerability may result in violations of these standards due to unauthorized data exposure, impacting confidentiality requirements mandated by such regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Streamlink versions 8.3.0 and earlier processing malicious HLS (.m3u8) or DASH (.mpd) playlists that contain file:// URIs, leading to arbitrary local file reads.
To detect exploitation attempts or presence of this vulnerability on your system or network, you can:
- Monitor network traffic for downloads or accesses of .m3u8 or .mpd playlist files containing file:// URIs.
- Inspect Streamlink command usage or logs for invocations processing remote playlists that might include suspicious file:// segments.
- Use commands to search for file:// URIs inside playlist files before processing them, for example:
- grep -r 'file://' /path/to/downloaded/playlists/
- If you have access to Streamlink logs or command history, check for commands like:
- streamlink <URL-of-remote-playlist>
- where the remote playlist URL might be hosting malicious content.
Additionally, ensure your Streamlink version is updated to 8.4.0 or later, which includes the fix preventing file:// URI processing.