CVE-2026-111728
Received Received - Intake

Argument Injection in Seanime Media Server via ffmpeg Options

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111728
EUVD
EUVD-2026-102897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
5rahim Seanime 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an argument injection flaw in Seanime versions 3.7.0 to 3.10.3. It allows unauthenticated LAN or Tailnet clients to bypass authorization by setting transcodeHwAccel to custom and injecting attacker-controlled decodeFlags and encodeFlags via transcodeHwAccelCustomSettings. These values are appended directly to ffmpeg command-line arguments, enabling arbitrary file write, file truncation, local file read, and outbound data exfiltration through ffmpeg's protocol handlers.

Detection Guidance

To detect this vulnerability, check if Seanime is running version 3.7.0 to 3.10.3. Inspect network traffic for mediastream requests or HLS playlist endpoints with transcodeHwAccel set to custom and transcodeHwAccelCustomSettings containing decodeFlags or encodeFlags. Review ffmpeg command logs for unexpected arguments or file operations.

Impact Analysis

An attacker could exploit this to write or truncate arbitrary files on your system with the permissions of the user running Seanime. They could also read local files or exfiltrate data outbound by leveraging ffmpeg's protocol handlers. This requires access to your LAN or Tailnet but does not need authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized file writes or reads may result in data breaches, triggering compliance obligations such as breach notifications and potential fines.

Mitigation Strategies

Immediately upgrade Seanime to version 3.10.4 or later. Disable unauthenticated LAN or Tailnet access if possible. Monitor for unusual file writes or ffmpeg command executions. Restrict network access to Seanime's endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart