CVE-2026-92164
Received Received - Intake

Cross-Protocol Redirect Bypass in Streamlink

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-92164
EUVD
EUVD-2026-85336

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
streamlink streamlink 8.6.0
streamlink streamlink to 8.6.0 (exc)
streamlink streamlink to 8.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Streamlink versions before 8.6.0 allows an attacker to redirect an HTTP(S) request to a local file URL (file://). HTTPSession follows this redirect and reads the local file, returning its contents as part of the stream output. This bypasses direct file URL checks and can expose sensitive files on the victim's system.

Detection Guidance

To detect this vulnerability, check if your Streamlink version is below 8.6.0. Run: streamlink --version. If the version is 8.5.0 or earlier, the system is vulnerable. Monitor network traffic for unexpected file:// redirects in HTTP(S) responses.

Impact Analysis

An attacker could exploit this to read sensitive files on your system, such as configuration files or system files like /etc/hosts. The attack does not require special privileges or file:// input, making it accessible to remote attackers controlling a server you connect to.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Exposure of local files may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Streamlink to version 8.6.0 or later immediately. Use the command: pip install --upgrade streamlink. Avoid using untrusted streams or URLs until patched. Disable file protocol handling if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart