CVE-2026-92164: Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Streamlinkto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Streamlink versions prior to 8.6.0 are exposed when Streamlink accesses an HTTP or HTTPS URL controlled by a remote server. The issue applies to every request made through HTTPSession, including media segment fetches.
What does an attacker need to exploit it?
An attacker needs control of an HTTP or HTTPS URL that Streamlink reaches and must cause the user to process it. The server can return a redirect to a file:// URL, which HTTPSession may read as a local file.
Can this affect HLS or DASH streams despite file URL checks?
Yes. The existing direct file URL checks can be bypassed when a manifest supplies an ordinary network URL and the server later redirects that request to a file:// URL. A redirected segment fetch can place local file contents into the stream output.
What is the remediation?
Upgrade Streamlink to version 8.6.0, which fixes the issue. Until upgrading is possible, avoid processing streams or manifests from untrusted HTTP or HTTPS servers, since any HTTPSession request may be redirected to a local file.