CVE-2026-77385 Overview
Kyoo is a self-hosted media server for movies, series, and anime. CVE-2026-77385 is a broken access control vulnerability [CWE-639] in Kyoo versions prior to 5.1.0. Any authenticated user holding the core.play permission can submit a base64-encoded filesystem path to the transcoder and retrieve files that are not part of the Kyoo catalog. The transcoder validates only that the resolved path begins with Settings.SafePath, but never confirms that the requested file corresponds to a cataloged media record. Attackers with valid low-privilege accounts can read hidden, temporary, operational, or otherwise uncataloged files that live beneath the media directory.
Critical Impact
Authenticated users with the core.play permission can read arbitrary files under the media root that are not exposed through the Kyoo catalog, leading to information disclosure.
Affected Products
- Kyoo self-hosted media server
- All releases prior to version 5.1.0
- Deployments exposing the transcoder API to registered users
Discovery Timeline
- 2026-09-18 - CVE-2026-77385 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-77385
Vulnerability Analysis
The transcoder accepts a base64-encoded path parameter that identifies the media file to stream. In transcoder/src/api/path.go, the decoded value is cleaned with filepath.Clean and checked for the Settings.SafePath prefix before being passed to getHash. In transcoder/src/api/streams.go, the resulting path is served directly without querying the Kyoo catalog to confirm that the file is a registered media item.
The check enforces containment within the media root but does not enforce catalog membership. Any file beneath Settings.SafePath becomes reachable, including logs, backups, scratch files, and staged uploads that the operator never intended to expose. The vulnerability requires an authenticated user with the core.play permission and network access to the transcoder API.
Root Cause
The root cause is missing object-level authorization [CWE-639]. Access control in the transcoder is expressed as a filesystem prefix test rather than a lookup against the catalog that represents legitimately published media. Path canonicalization and prefix validation prevent traversal outside the media root but do nothing to constrain the set of files served inside it.
Attack Vector
An attacker authenticates to Kyoo with any account that carries the core.play permission. The attacker constructs a filesystem path pointing to a non-cataloged file under the media directory, base64-encodes it, and sends it to the transcoder streaming endpoint. If the target path exists and resolves within Settings.SafePath, the transcoder returns the file contents. Successful exploitation depends on knowing or guessing the target file path.
// Patch excerpt from transcoder/src/api/path.go
// Source: https://github.com/zoriya/Kyoo/commit/c542adb5dc6d681e6491b28b5ac618c35c446d91
import (
"encoding/base64"
+ "mime"
"net/http"
"path/filepath"
"strings"
The fix in pull request #1577 restricts the transcoder to video content and tightens path validation so non-media files under the safe path are rejected.
Detection Methods for CVE-2026-77385
Indicators of Compromise
- Transcoder requests from core.play users referencing base64-encoded paths that decode to files not present in the Kyoo catalog database.
- Successful stream responses for files with non-media extensions such as .log, .db, .tmp, or configuration files beneath Settings.SafePath.
- Repeated failed decode attempts or brute-force enumeration of filenames under the media root.
Detection Strategies
- Correlate transcoder access logs with the Kyoo catalog and flag any served path that does not correspond to a registered media entry.
- Alert on decoded transcoder paths whose file extension is outside the expected video and subtitle formats.
- Track per-user request rates against the transcoder to identify low-privilege accounts probing the media directory.
Monitoring Recommendations
- Forward Kyoo application logs, reverse proxy access logs, and container filesystem audit events to a centralized log platform.
- Retain authentication and permission-grant events for core.play so unusual account activity can be reconstructed after the fact.
- Baseline normal transcoder path patterns and generate alerts when new or previously unseen file paths appear.
How to Mitigate CVE-2026-77385
Immediate Actions Required
- Upgrade Kyoo to version 5.1.0 or later on all self-hosted instances.
- Audit accounts that hold the core.play permission and revoke access for users who do not require playback.
- Move non-media files, backups, and operational artifacts out of the directory referenced by Settings.SafePath.
Patch Information
The vulnerability is fixed in Kyoo 5.1.0. Details are available in the GitHub Security Advisory GHSA-fc8v-vr3q-hc46, the GitHub Release v5.1.0, the remediation commit, and the pull request #1577. The fix restricts the transcoder to serving cataloged video content and rejects requests for other files under the safe path.
Workarounds
- Restrict network access to the Kyoo transcoder API so only trusted users can reach it while patching is planned.
- Ensure the media directory contains only files intended for streaming, with no logs, secrets, or configuration files present.
- Temporarily remove the core.play permission from untrusted or shared accounts until the upgrade is complete.
# Verify the running Kyoo version and upgrade the container image
docker inspect kyoo --format '{{.Config.Image}}'
docker pull zoriya/kyoo:5.1.0
docker compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
