UBUNTU-CVE-2026-120210: Path Traversal
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use the IMF demuxer to process attacker-supplied or otherwise untrusted IMF packages are exposed. The described impact is opening or probing local MXF files outside the supplied package, and potentially causing server-side requests.
What does an attacker need to exploit it?
An attacker needs to provide a crafted IMF package containing unvalidated ASSETMAP Path elements, such as paths using '..' traversal sequences or absolute paths. The published vector indicates exploitation is network-reachable, requires no privileges, and requires user interaction.
Are default installations affected?
The available data identifies FFmpeg versions 5.0 through 9.0.2, but does not state whether the IMF demuxer is enabled or used by default in Ubuntu packages. Exposure depends on whether the affected software processes an untrusted IMF package.
What can be done before a patch is available?
Do not process untrusted IMF packages with the affected software. Restrict package inputs to trusted sources and prevent the processing service from accessing sensitive local files or making unnecessary outbound requests.