{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gstreamer-adaptive-streaming-demuxers/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-121629"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GStreamer (adaptive streaming demuxers)","GStreamer"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["GStreamer"],"content_html":"\u003cp\u003eA vulnerability exists in GStreamer's adaptive streaming demuxers (HLS, DASH, and MSS) where URI schemes for remote resources are not validated during the processing of media manifests. An attacker who can influence the manifest URL or inject content into the manifest response can force the GStreamer-based application to process file:// URIs. This results in the application reading local files from the filesystem. In server-side environments such as media proxies, recorders, or downloaders, this can lead to the disclosure of sensitive files or the enumeration of file existence via error responses.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized disclosure of arbitrary local files accessible to the application process. Attackers may also infer the existence of files on the system based on differential error responses returned by the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all applications and services utilizing GStreamer for adaptive media streaming (HLS, DASH, MSS) to identify potential exposure.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sanitization for all media manifest URIs to ensure only expected schemes (e.g., http, https) are processed.\u003c/li\u003e\n\u003cli\u003eMonitor for applications attempting to access unauthorized local file paths via network-oriented media processing components.\u003c/li\u003e\n\u003cli\u003ePatch or update GStreamer libraries as soon as an official security update is released by the GStreamer maintainers for CVE-2026-121629.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T16:05:46Z","date_published":"2026-11-09T13:48:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gstreamer-uri-traversal/","summary":"A vulnerability in GStreamer adaptive streaming demuxers allows attackers to read arbitrary local files by injecting file:// URIs into media manifests.","title":"GStreamer: Arbitrary local file read via adaptive streaming demuxers (CVE-2026-121629)","url":"https://feed.craftedsignal.io/briefs/2026-11-gstreamer-uri-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - GStreamer (Adaptive Streaming Demuxers)","version":"https://jsonfeed.org/version/1.1"}