CVE-2026-72571: cast-localvideo Path Traversal Flaw

CVE-2026-72571 Overview

CVE-2026-72571 is a path traversal vulnerability [CWE-22] in the mustafaakin/cast-localvideo Node.js application. All versions are affected. An unauthenticated remote attacker can read arbitrary files from the server by supplying crafted input to the dir request body parameter. The app.js handler at lines 151-153 passes req.body.dir directly to res.sendFile() without sanitization. Attackers can supply absolute paths or ../ sequences to escape the intended directory and access sensitive system files such as /etc/passwd or application configuration data.

Critical Impact
Unauthenticated attackers can exfiltrate arbitrary readable files from the host filesystem over the network without user interaction.

Affected Products

mustafaakin/cast-localvideo — all versions
Node.js applications embedding the vulnerable app.js handler
Deployments exposing the service to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72571 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72571

Vulnerability Analysis

The vulnerability exists in the file-serving handler of cast-localvideo, a small Node.js/Express application used to stream local video files to cast devices. The handler receives a client-supplied dir value in the request body and forwards it directly to Express's res.sendFile() API. Because res.sendFile() will serve any file the Node process can read when given an absolute path, and because no allowlist or normalization is applied, the parameter effectively becomes an arbitrary file read primitive.

Exploitation requires no authentication and no user interaction. An attacker with network reachability to the service issues a single HTTP request containing a traversal payload in the dir field. The server responds with the contents of the requested file. Impact is limited to confidentiality; the vulnerability does not directly permit modification of files or code execution.

Root Cause

The root cause is missing input validation on the req.body.dir parameter. The handler at app.js lines 151-153 does not resolve the path, verify it stays within a designated media root, or reject absolute paths and .. segments. This is a textbook instance of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-based. An attacker sends a POST request to the vulnerable endpoint with a dir value pointing to a sensitive absolute path, or a relative path containing ../ sequences that resolve outside the intended media directory. Because no session, token, or origin check is enforced, the request succeeds for any client that can reach the service. See the GitHub source code for the vulnerable handler.

Detection Methods for CVE-2026-72571

Indicators of Compromise

HTTP request bodies containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f in the dir parameter.
Requests where dir is set to absolute paths such as /etc/passwd, /root/.ssh/id_rsa, or Windows equivalents like C:\Windows\win.ini.
Unexpected outbound responses from the cast-localvideo process containing contents of system or configuration files.

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to the cast-localvideo service with suspicious dir values.
Deploy WAF rules that block traversal patterns and absolute filesystem paths in request bodies for the affected endpoint.
Correlate process-level file read events on the host with inbound HTTP requests to identify anomalous file access driven by the Node.js process.

Monitoring Recommendations

Alert on the node process reading files outside the configured media directory.
Track baseline request patterns for the service and flag requests with non-media file extensions or path separators.
Forward application logs to a centralized store and retain them long enough to support retrospective hunting.

How to Mitigate CVE-2026-72571

Immediate Actions Required

Remove cast-localvideo from any network-reachable interface until a fix is applied. Bind the service to 127.0.0.1 only.
Place the service behind an authenticated reverse proxy that enforces access control on the vulnerable endpoint.
Audit host filesystems for evidence of sensitive file reads originating from the Node.js process.

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Operators should fork the project or apply a local code change that resolves the user-supplied dir against a fixed media root using path.resolve() and rejects any resolved path that does not start with that root. Review the project repository for any subsequent fixes.

Workarounds

Validate req.body.dir against an allowlist of known media files or subdirectories before invoking res.sendFile().
Normalize the input with path.resolve() and verify the result is a prefix of the intended media root.
Run the service as a low-privilege user inside a container or chroot so that traversal cannot reach sensitive system files.
Enforce network segmentation so only trusted client devices can reach the service.

bash

# Example nginx reverse proxy restriction limiting access to a trusted subnet
location /cast/ {
    allow 192.168.1.0/24;
    deny all;
    proxy_pass http://127.0.0.1:3000/;
}