CVE-2026-77385: Kyoo: Transcoder serves uncataloged files from the media directory
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kyooto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A registered Kyoo user who has the core.play permission can exploit it. The attacker also needs to know or guess the path of an uncataloged file located beneath the configured media directory.
Are files outside the media directory exposed?
The described path validation required the supplied path to begin with Settings.SafePath, so the affected exposure is limited to files beneath the media directory. Catalog visibility was not enforced for those accepted paths.
What is the remediation?
Upgrade Kyoo to version 5.1.0, which fixes the missing catalog-level authorization check. Until upgrading, restrict core.play permission to trusted users and avoid keeping hidden, temporary, or operational files under the media directory.
How can I determine whether my deployment is affected?
Deployments running a Kyoo version prior to 5.1.0 are affected if users with core.play can access the transcoder and uncataloged files exist beneath the media directory. Review whether such files are stored there and whether untrusted registered users have core.play permission.