CVE-2026-111728: Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated clients on the local network or Tailnet can exploit it. Exploitation does not require prior privileges or user interaction.
What conditions are needed to trigger the vulnerable behavior?
An attacker must set transcodeHwAccel to custom and provide controlled decodeFlags and encodeFlags through transcodeHwAccelCustomSettings. They can then trigger processing through mediastream requests or HLS playlist endpoints.
What access and impact can exploitation provide?
The injected values are appended verbatim to the ffmpeg argument vector. This can result in arbitrary file writes and file truncation as the user running Seanime; injected input options may also permit local file reads and outbound data exfiltration through ffmpeg protocol handlers.
Are default authorization protections sufficient?
No. The issue is reachable through improper authorization and allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard.