CVE-2026-30121: Remotion Path Traversal Vulnerability

CVE-2026-30121 Overview

CVE-2026-30121 is an arbitrary file write vulnerability affecting remotion-dev remotion version 4.0.409. Remotion is a programmatic video creation framework for React developers. The flaw allows unauthenticated network-based attackers to write files to arbitrary locations on a system running the vulnerable component. The weakness is classified under CWE-123: Write-what-where Condition. Successful exploitation can compromise integrity and availability of the host application by overwriting configuration files, application code, or system binaries. The vulnerability does not require user interaction or prior authentication.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to the filesystem, enabling code execution, configuration tampering, and denial of service against applications running remotion4.0.409.

Affected Products

remotion-dev/remotion version 4.0.409
Applications and rendering pipelines that depend on the affected remotion package version
Node.js services bundling remotion:4.0.409 for video composition or server-side rendering

Discovery Timeline

2026-06-15 - CVE-2026-30121 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-30121

Vulnerability Analysis

The vulnerability in remotion4.0.409 permits an arbitrary file write through unsanitized path handling exposed over the network. Under CWE-123: Write-what-where Condition, an attacker controls both the destination path and the content written. This category of flaw bypasses the intended file-system boundary of the application. Remotion's runtime is typically invoked by server-side video rendering workflows that accept user-influenced inputs such as composition props, output filenames, or asset paths. When those inputs flow into write operations without canonicalization or allowlist checks, the writer can traverse directories or target absolute paths outside the intended output directory. The impact is high for integrity and availability because attackers can overwrite source files, deployment manifests, or scheduled task definitions used by the Node.js host.

Root Cause

The root cause is insufficient validation of file-path parameters consumed by Remotion's write operations. Path inputs are not normalized against an allowed output root, permitting .. segments or absolute paths to escape the rendering directory. The advisory does not disclose the specific function or sink at the time of this writing.

Attack Vector

The attack vector is network-based with no privileges and no user interaction required. An adversary submits crafted input to an endpoint or workflow that forwards values into Remotion's file-writing logic. The attacker then specifies a destination path outside the intended directory and supplies content that, once written, replaces a sensitive file. Refer to the GitHub Security Advisory for any published reproduction details.

// No verified exploitation code is published for CVE-2026-30121.
// See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-30121

Indicators of Compromise

Unexpected file writes outside the configured Remotion output directory, including writes to application source paths, node_modules, or system directories.
Modifications to configuration files such as package.json, .env, or process supervisor units on hosts running Remotion rendering workloads.
HTTP requests to rendering endpoints containing path traversal sequences like ..\/ or absolute paths in composition props or output filename fields.

Detection Strategies

Inventory dependencies and flag any service using remotion4.0.409 via software composition analysis or npm ls remotion checks in CI.
Enable file integrity monitoring on directories containing application code, deployment scripts, and Node.js runtime files on render hosts.
Inspect application logs for render jobs whose resolved output path falls outside the expected rendering working directory.

Monitoring Recommendations

Forward Node.js application logs and operating system audit events for open, write, and rename syscalls to a centralized log platform for correlation.
Alert on process executions spawned from directories that Remotion should only use for read-only assets.
Monitor outbound network connections from Remotion render workers to detect post-exploitation staging following an arbitrary write.

How to Mitigate CVE-2026-30121

Immediate Actions Required

Identify all systems running remotion4.0.409 and treat exposed render endpoints as untrusted until upgraded.
Restrict network exposure of Remotion render services so they are reachable only from trusted internal callers.
Run Remotion processes under a least-privilege service account that cannot write to application source, configuration, or system paths.

Patch Information

At the time of publication, the GitHub Security Advisory is the authoritative reference. Upgrade to a fixed version of remotion once published by the maintainers and validate the upgrade in a staging environment before production rollout.

Workarounds

Validate and canonicalize every file path parameter before passing it to Remotion APIs, rejecting absolute paths and any input containing .. segments.
Run rendering workloads inside a container or sandbox with a read-only root filesystem and a single writable volume scoped to the output directory.
Place a reverse proxy or API gateway in front of Remotion endpoints to enforce input schema validation and authentication.

bash

# Configuration example: pin a non-vulnerable version once released and run with least privilege
npm ls remotion
npm install remotion@latest --save-exact

# Example systemd hardening for a Remotion render service
# /etc/systemd/system/remotion-render.service.d/hardening.conf
# [Service]
# ReadOnlyPaths=/
# ReadWritePaths=/var/lib/remotion/output
# NoNewPrivileges=true
# ProtectSystem=strict
# ProtectHome=true