CVE-2026-72571: mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter
A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72571?
CVE-2026-72571 has a high severity rating of 7.5.
How does CVE-2026-72571 affect mustafaakin/cast-localvideo?
CVE-2026-72571 allows an unauthenticated remote attacker to perform a path traversal attack and read arbitrary files from the server.
What versions of mustafaakin/cast-localvideo are affected by CVE-2026-72571?
All versions of mustafaakin/cast-localvideo are affected by CVE-2026-72571.
How can I fix CVE-2026-72571?
To fix CVE-2026-72571, ensure proper sanitization of the user-supplied req.body.dir parameter before passing it to res.sendFile().
What type of vulnerability is CVE-2026-72571 classified as?
CVE-2026-72571 is classified as a Path Traversal vulnerability.