CVE-2026-44353: Streamlink Path Traversal Vulnerability

CVE-2026-44353 Overview

CVE-2026-44353 is a path traversal vulnerability in Streamlink, a command-line utility that pipes video streams into media players. Versions prior to 8.4.0 fail to validate the URI scheme of segment entries in HLS playlists and DASH manifests. A remote .m3u8 or .mpd resource can reference file:/// URIs as segments, causing Streamlink to read local files and write their contents to the output stream. The flaw is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Version 8.4.0 resolves the issue.

Critical Impact
A remote attacker can trick a user into loading a malicious playlist that exfiltrates arbitrary local files into the Streamlink output stream.

Affected Products

Streamlink versions prior to 8.4.0
HLS parser component
DASH parser component

Discovery Timeline

2026-05-27 - CVE-2026-44353 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44353

Vulnerability Analysis

Streamlink processes HTTP Live Streaming (HLS) playlists in .m3u8 format and Dynamic Adaptive Streaming over HTTP (DASH) manifests in .mpd format. Both formats list segment URIs that the client fetches in sequence and writes to a video player or output file.

The parsers in versions before 8.4.0 accept any URI scheme without validation. When a segment entry uses file:///path/to/file, the underlying request layer treats it as a local file read rather than a network fetch. Streamlink then writes the file contents to the output stream as if it were video data.

This enables local file disclosure when a user opens a remote playlist hosted by an attacker. The impact scope is limited to file confidentiality, since the vulnerability requires user interaction to load the malicious resource.

Root Cause

The HLS and DASH parsers do not enforce an allowlist of permitted URI schemes such as http and https. The segment loader passes URIs directly to a request handler that supports file:// access. The absence of scheme validation allows the parser to follow references outside the intended network transport.

Attack Vector

An attacker hosts a crafted .m3u8 or .mpd manifest containing segment entries with file:/// URIs targeting sensitive files such as /etc/passwd, SSH keys, or configuration files. The attacker then convinces a victim to play the URL with Streamlink. Streamlink reads the referenced local file and streams its contents to the configured output, where the attacker can recover it if the output is piped to a network-reachable destination or if the attacker controls a relay player.

The vulnerability requires user interaction. Network-borne delivery through a phishing link or malicious site referencing the playlist is the most plausible exploitation path. See the Streamlink GitHub Security Advisory GHSA-hgqw-6m45-hw5f for technical details.

Detection Methods for CVE-2026-44353

Indicators of Compromise

HLS .m3u8 or DASH .mpd files containing segment URIs that begin with file:// instead of http:// or https://
Streamlink process activity correlated with reads of sensitive local files such as /etc/passwd, ~/.ssh/, or application configuration directories
Outbound network connections from Streamlink output pipelines that follow unusual local file access

Detection Strategies

Inspect cached or downloaded playlist files for non-HTTP URI schemes prior to playback
Monitor Streamlink versions deployed across endpoints and flag installations below 8.4.0
Apply YARA or content rules that flag file:// strings inside .m3u8 and .mpd files in transit

Monitoring Recommendations

Log command-line invocations of streamlink along with the requested URL for forensic review
Alert on Streamlink processes opening files outside expected media directories
Track egress traffic from hosts running Streamlink for unexpected data volumes following playlist loads

How to Mitigate CVE-2026-44353

Immediate Actions Required

Upgrade Streamlink to version 8.4.0 or later on all systems where it is installed
Audit any automated workflows that consume third-party playlists with Streamlink
Restrict Streamlink execution to least-privileged user accounts that lack access to sensitive files

Patch Information

The vulnerability is fixed in Streamlink 8.4.0. The release adds URI scheme validation to the HLS and DASH parsers, rejecting non-HTTP(S) segment references. Refer to the Streamlink GitHub Security Advisory GHSA-hgqw-6m45-hw5f for the patch commit and release notes.

Workarounds

Avoid loading .m3u8 or .mpd URLs from untrusted sources until the upgrade is applied
Run Streamlink inside a sandbox or container with no access to sensitive host paths
Pre-validate playlist contents with a script that rejects any URI scheme other than http or https before invoking Streamlink

bash

# Configuration example: validate a playlist before passing it to Streamlink
curl -sS "$PLAYLIST_URL" -o /tmp/playlist.m3u8
if grep -E '^(file|ftp|gopher|data)://' /tmp/playlist.m3u8; then
  echo "Rejected: non-HTTP URI scheme detected" >&2
  exit 1
fi
streamlink /tmp/playlist.m3u8 best