CVE-2026-81028
Received Received - Intake

ZLMediaKit Directory Traversal Vulnerability

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath("", item, true); because the relative-path argument is empty that helper returns the value without a trailing separator. The handler then accepts a requested path when start_with(file_path, root) holds, so a sibling directory whose name merely begins with the configured root string satisfies the test and is served. The only other guard rejects a path containing two dots, which this requires none of. The equivalent confinement check for the ordinary static file server in src/Http/HttpFileManager.cpp computes its root with a non-empty second argument, which appends the separator before comparing, and so is not affected. The endpoint requires the configured API secret, so this grants no privilege beyond what that secret already implies, but it reads files outside the directory the operator confined it to, and the reference container runs the server as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-81028
EUVD
EUVD-2026-66604

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zlmediakit zlmediakit *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZLMediaKit's downloadFile API restricts file downloads to configured root directories using a prefix comparison. However, the check fails to account for directory boundaries because the root path lacks a trailing separator. This allows an attacker to request files from sibling directories whose names start with the configured root string. The endpoint requires an API secret, so the impact is limited to unauthorized file access within the granted permissions.

Impact Analysis

This vulnerability allows an attacker with access to the API secret to read files outside the intended restricted directories. If the server runs as root, the attacker could access sensitive system files. The impact is unauthorized file disclosure but does not grant elevated privileges beyond what the API secret already permits.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using ZLMediaKit may face compliance violations if unauthorized file access occurs, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Update ZLMediaKit to the latest version where the directory confinement logic is fixed. Ensure the API secret is strong and not exposed. Review file access logs for suspicious requests that bypass directory restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart