CVE-2026-72571 - Vulnerability Details - OpenCVE

A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://github.com/mustafaakin/cast-localvideo
https://github.com/mustafaakin/cast-localvideo/blob/main/app.js

History

Mon, 10 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 10 Aug 2026 11:00:00 +0000

Type	Values Removed	Values Added
Description		A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.
Title		mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter
Weaknesses		CWE-22
References		https://github.com/mustafaakin/cast-localvideo https://github.com/mustafaakin/cast-localvideo/blob/main/app.js
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: TuranSec

Published: 2026-08-10T10:40:49.281Z

Updated: 2026-08-10T17:51:58.118Z

Reserved: 2026-08-10T10:32:53.853Z

Link: CVE-2026-72571

Vulnrichment

Updated: 2026-08-10T17:51:54.528Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-10T13:00:04Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72571", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:53.853Z", "datePublished": "2026-08-10T10:40:49.281Z", "dateUpdated": "2026-08-10T17:51:58.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:34.957Z"}, "title": "mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter", "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.</p>"}]}], "affected": [{"vendor": "mustafaakin", "product": "cast-localvideo", "versions": [{"version": "0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/mustafaakin/cast-localvideo", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mustafaakin/cast-localvideo/blob/main/app.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "credits": [{"lang": "en", "value": "Bo'riboy Abdurahmonov", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "timeline": [{"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "CVE Reserved"}, {"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "Public Disclosure"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-10T10:32:53.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T17:51:48.940720Z", "id": "CVE-2026-72571", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:51:58.118Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T17:51:48.940720Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T17:51:54.528Z"}}], "cna": {"title": "mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bo'riboy Abdurahmonov"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "mustafaakin", "product": "cast-localvideo", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "CVE Reserved"}, {"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "Public Disclosure"}], "datePublic": "2026-08-10T10:32:53.000Z", "references": [{"url": "https://github.com/mustafaakin/cast-localvideo", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/mustafaakin/cast-localvideo/blob/main/app.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.", "supportingMedia": [{"type": "text/html", "value": "<p>A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:34.957Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72571", "state": "PUBLISHED", "dateUpdated": "2026-08-10T17:51:58.118Z", "dateReserved": "2026-08-10T10:32:53.853Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-10T10:40:49.281Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}