CVE-2026-81028: ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision
ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath("", item, true); because the relative-path argument is empty that helper returns the value without a trailing separator. The handler then accepts a requested path when startwith(filepath, root) holds, so a sibling directory whose name merely begins with the configured root string satisfies the test and is served. The only other guard rejects a path containing two dots, which this requires none of. The equivalent confinement check for the ordinary static file server in src/Http/HttpFileManager.cpp computes its root with a non-empty second argument, which appends the separator before comparing, and so is not affected. The endpoint requires the configured API secret, so this grants no privilege beyond what that secret already implies, but it reads files outside the directory the operator confined it to, and the reference container runs the server as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the configured API secret to call the downloadFile API. The issue does not grant access beyond the privileges already associated with that secret, but a holder can read files outside the configured download roots.
Is the ordinary static file server affected?
No. The described prefix-comparison flaw is specific to the downloadFile API configuration path in server/WebApi.cpp. The ordinary static file server uses a root value with a trailing directory separator and is not affected by this issue.
What configuration makes a system vulnerable?
A system is affected when downloadFile is configured with one or more root directories and there is a readable sibling path whose name begins with one of those root strings. For example, a configured root can be bypassed by a sibling directory sharing that exact prefix without requiring dot-dot path components.
What is the impact if the service runs as root?
Files readable by the ZLMediaKit process outside the intended configured roots may be exposed through downloadFile. The reference container runs the server as root, so the accessible file set may be particularly broad.