UBUNTU-CVE-2026-121629: Medium severity ubuntu/gst-plugins-good1.0 vulnerability
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Automated or server-side applications that use the affected GStreamer adaptive streaming demuxers, including media recorders, proxies, and downloaders, are most exposed. These deployments may fetch attacker-controlled manifests and can disclose local-file contents through their processing or output.
What does an attacker need to exploit the flaw?
An attacker must control a manifest URL or be able to inject content into an HTTP manifest response. They can then add file:// URIs that reference arbitrary local files.
What is the impact if file contents are not directly returned to the attacker?
An attacker may still infer whether local files exist based on differing error responses. This can reveal information about the filesystem even when file content is not observable.